On the subject of Let's Encrypt certificate renewal, is there any way of notifying that the certificate as been renewed at the time of renewal?
Recently I noticed, at last, that my certificate had been auto-renewed (I am still using DSM 6.2.4). Accessing the NAS via iPad or iPhone I had a message that the certificate had changed and did I trust it. I then checked the certificate and found that it had an extra 90 days. It would help to know that the certificate has changed. (Perhaps DSM 7 does that, but going on comments her, I am in no hurry to install that yet.)

Is there anyway to for the LE renewals over port 443?

It used to work years ago, before LE deprecated the tls-challange due to security flaws.
I am afraid you'll have to make port 80 available for a LE renewal.

N.B.: there is also the dns-challenge, that requires the injection of txt-records in the dns hosted zone.

one-eyed-king said:

there is also the dns-challenge, that requires the injection of txt-records in the dns hosted zone.

Click to expand...

If my domain provider supports these txt records, can I do dns challenge renewals?

I am not aware if the Syno Cert Manager implents dns-challenge.

Though, other LE clients like acme.sh do support it well - if there is build-in support for your dns provider than it's even nicer. Acme.sh even has a hook to upload renewed certificates back to the cert manager. On top you will be able to issue wildcard certificates.

one-eyed-king said:

I am not aware if the Syno Cert Manager implents dns-challenge

Click to expand...

Atm, still no support.

Rusty said:

Atm, still no support.

Click to expand...

Rusty, I know you have a guide for wildcard certs using cloud flare.

Here’s my dilemma, I have a free website hosted by google using my domain name. Everything else that I use for RP is for subdomains. Is there a way to do that wildcard cert and cloudflare without hitting the main domain, only the subdomains?

Gerard said:

Is there a way to do that wildcard cert and cloudflare without hitting the main domain, only the subdomains?

Click to expand...

This is not possible, but you can get individual certs for each subdomain. But why not a full wildcard cert based on the primary domain?

Gerard said:

Rusty, I know you have a guide for wildcard certs using cloud flare.

Here’s my dilemma, I have a free website hosted by google using my domain name. Everything else that I use for RP is for subdomains. Is there a way to do that wildcard cert and cloudflare without hitting the main domain, only the subdomains?

Click to expand...

CF will require a root domain registration.

I recently moved three domains to Cloudflare: for each domain the dns entries (subdomains, mx records, ...) where detected and suggested to "move" as well.

No doubt there wouldn’t be an issue moving it to cloudflare, my issue is the website of my root domain which is hosted by google domains breaks. It’s as if the root domain needs to remain with googles name servers for the website.

You don't have to use CF necessarily. see: dnsapi · acmesh-official/acme.sh Wiki
If your dns service provider is not in the list, then dns-challenge won't be possible for you.

one-eyed-king said:

You don't have to use CF necessarily. see: dnsapi · acmesh-official/acme.sh Wiki
If your dns service provider is not in the list, then dns-challenge won't be possible for you.

Click to expand...

How do I implement something like this? Is this thru dnspod.com?

I have no idea if you use google cloud dns or not, or if your dns provider is in the list at all.
I don't want to be rude, but have you tried googling it?

one-eyed-king said:

I have no idea if you use google cloud dns or not, or if your dns provider is in the list at all.
I don't want to be rude, but have you tried googling it?

Click to expand...

I use google domains, but unsure of this is also considered google cloud.
Yes there’s not much information about acme.sh support