LE Cert renewal failures

[Telos]

I received LE renewal notification emails for NAS1 and NAS2 and attempted renewal by forwarding port 80 to NAS1 IP.
Renewal went fine.

Then I edited the port 80 forward to point to NAS2 IP. Renewal failed:

Restarted NAS2 with the same result (and now with port 443 open as well).

Then I tried to create a new LE cert with same "secret.synology.me" domain manually to replace the existing cert and I get this...

Doesn't seem like "Failed to connect" is an issue.

So, I'm stuck a bit trying to figure out how to proceed. Ideas?

 

[silverj]

Funnily enough I had exactly the same problem with my renewals recently.

In my case the DDNS IP address needed updating, then it worked. The second error you have received is when you make too many attempts to renew/create a certificate. I have had this in the past too. (There are daily and weekly limits I believe (I stress this is from odd forum posts in odd places over years, so it is not gospel) when working with Let's Encrypt.)
So try again in a couple of days... Hopefully it will work.

 

[Telos]

Funnily enough I had exactly the same problem with my renewals recently.

Thanks for the encouragement. I'll wait a week.

I did read that if the SAN was modified, that I could circumvent the blocks... but that only resulted in a "failed to connect" notice. Fortunately this is a backup NAS, and not the primary which updated without incident.

 

[Telos]

It seems I am doomed. I forwarded ports 80 and 443, tried both renew and replace certs and get a "no connection" popup from the Synology GUI.

I'm stuck. I even tried obtaining the cert from another Synology NAS, and got the no connection warning.

Is my only recourse to purchase a domain?

 

[Rusty]

Best to consult /var/log/messages for a more detailed info on the problem

 

[Telos]

Best to consult /var/log/messages for a more detailed info on the problem

Good call. When I did this I found repeated errors such as this
2021-07-14T10:02:52-05:00 NAS4 synoscgi_SYNO.Core.Certificate.LetsEncrypt_1_renew[19052]: certificate.cpp:969 syno-letsencrypt failed. 101 [Fetching http://xxxxxxxx.ddns.net/.well-known/acme-challenge/v44wye0rC1F-NBA8j6ovDx5pd2W5RqkwA0IjFictNL8: Timeout during connect (likely firewall problem)]

The problem is that xxxxxxxx.ddns.net is one of the SAN entries, instead of the xxxxxxxx.synology.me I was attempting to renew.

Why would it be using that URL?

In the past it had a related problem. When it failed because it used the Synology wildcard entry in SAN.

2021-02-15T11:30:16-05:00 NAS2 synoscgi_SYNO.Core.Certificate.LetsEncrypt_1_create[3482]: certificate.cpp:966 syno-letsencrypt failed. 108 [*.xxxxxxxx.synology.me is not Synology ddns]

Is that last line not odd.

Or am I going about this all wrong?

Maybe I need to include the DDNS domain in the SAN field?

 

[Telos]

Methinks I've found an issue with the DDNS. Still can't explain the odd error with the Synology wildcard, but possible with the "ddns.net" address.

I'll wait 24 hours to retest.