Question LE Cert | Synology DDNS Wildcard

Currently reading
Question LE Cert | Synology DDNS Wildcard

4,027
1,378
NAS
DS4l8play, DS202j, DS3623xs+, DSM 7.3.3-25847
It's been often said that the Synology doesn't support wildcard use. I see that limit in the LE Cert tool on my NAS.

Is this specific for the Synology LE Cert registration, alone, or also for the Synology DDNS domains?

For example, if I manage to get the LE Cert process working on Docker, can I register *.secretword.synology.me and expect it to work?
 
Last edited:
For example, if I manage to get the LE Cert process working on Docker, can I register *.secretword.synology.me and expect it to work?
I am (still) using Traefik 1.7.x and its build in LE integration. The precondition for wildcard certificate creation is a supported registrar (as in the dns-api is supported by certbot/traefik). During the creation of a wildcard certificate a "txt" entry is added to your Domain and verified by the LE client.

I highly doubt that synology provides access to the dns-api, do they?

I have a couple of domains registered and my registrar is supported - works flawless with Traefik's LE integration.

Update: I forget to mention that Syno's LE integration does only support the HTTP-01 challenge, which does not allow to creat wildcard certifcates. You will either need Certbot or Traefik for this. If you are working with docker-compose, Traefik is a feasable option. Afaik the required labels are not maintainable from the ui. TBH, I just made a couple of tests with Traefik on the DS, but have no long term experience with it. My long term experience is only with dedicated Swarm clusters - Traefik works like a champ in this setup.
 
I highly doubt that synology provides access to the dns-api, do they?
No, they don't. Even so, with a wild card cert you will need to own the root domain as well (or have control over it) and none of us does, so registering a wild card sub domain on *.synology.me is not an option.

As King said, LE container, Traefik, are your docker alternatives for now, until DSM7 comes out.

In DSM7 there will be a native support for this as noted in the release notes for the Preview version:

Security
  • Added support for Let’s Encrypt wildcard certificates when using Synology DDNS service.
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Wildcard domains require DNS verification. Synology have no control over other people's DNS records hence...
Replies
23
Views
4,627
wildcard cert always, just use the Search tool on this forum regarding LE cert issues, and you will get...
Replies
7
Views
2,321
  • Question
Methinks I've found an issue with the DDNS. Still can't explain the odd error with the Synology wildcard...
Replies
6
Views
2,146
  • Question
When you login to the NAS and experience this issue of the certificate, check what is reported as the...
Replies
13
Views
2,403
M
i use the built-in function in DSM to get the certificate. There was nothing more to do and everything...
Replies
11
Views
1,982
makon
M
I am setting up a new DS224+ unit for a client. Not new to NAS drives but new to Synology. Storage pool...
Replies
0
Views
346
agree, but yet another good reminder that it is amongst good security practices to disable the default...
Replies
3
Views
841

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Back
Top