Question LE Cert | Synology DDNS Wildcard

Currently reading
Question LE Cert | Synology DDNS Wildcard

Telos

Subscriber
2,636
850
NAS
DS418play, DS213j, DS3622+, DSM 7.2.4-11091
It's been often said that the Synology doesn't support wildcard use. I see that limit in the LE Cert tool on my NAS.

Is this specific for the Synology LE Cert registration, alone, or also for the Synology DDNS domains?

For example, if I manage to get the LE Cert process working on Docker, can I register *.secretword.synology.me and expect it to work?
 
Last edited:
For example, if I manage to get the LE Cert process working on Docker, can I register *.secretword.synology.me and expect it to work?
I am (still) using Traefik 1.7.x and its build in LE integration. The precondition for wildcard certificate creation is a supported registrar (as in the dns-api is supported by certbot/traefik). During the creation of a wildcard certificate a "txt" entry is added to your Domain and verified by the LE client.

I highly doubt that synology provides access to the dns-api, do they?

I have a couple of domains registered and my registrar is supported - works flawless with Traefik's LE integration.

Update: I forget to mention that Syno's LE integration does only support the HTTP-01 challenge, which does not allow to creat wildcard certifcates. You will either need Certbot or Traefik for this. If you are working with docker-compose, Traefik is a feasable option. Afaik the required labels are not maintainable from the ui. TBH, I just made a couple of tests with Traefik on the DS, but have no long term experience with it. My long term experience is only with dedicated Swarm clusters - Traefik works like a champ in this setup.
 

Rusty

Moderator
NAS Support
5,846
1,722
www.blackvoid.club
NAS
DS718+, DS918+, 2x RS3614RPxs+
Router
  1. RT1900ac
  2. RT2600ac
  3. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
I highly doubt that synology provides access to the dns-api, do they?
No, they don't. Even so, with a wild card cert you will need to own the root domain as well (or have control over it) and none of us does, so registering a wild card sub domain on *.synology.me is not an option.

As King said, LE container, Traefik, are your docker alternatives for now, until DSM7 comes out.

In DSM7 there will be a native support for this as noted in the release notes for the Preview version:

Security
  • Added support for Let’s Encrypt wildcard certificates when using Synology DDNS service.
 
Like i write, the current client only support HTTP-01 challenge. The client does not accept * or *.domain.tld as SAN.
I would recommend to wait for DSM7's buildin feature....
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Wildcard domains require DNS verification. Synology have no control over other people's DNS records hence...
Replies
23
Views
2,850
wildcard cert always, just use the Search tool on this forum regarding LE cert issues, and you will get...
Replies
7
Views
345
  • Question
Methinks I've found an issue with the DDNS. Still can't explain the odd error with the Synology wildcard...
Replies
6
Views
1,138
  • Question
When you login to the NAS and experience this issue of the certificate, check what is reported as the...
Replies
13
Views
1,227
M
i use the built-in function in DSM to get the certificate. There was nothing more to do and everything...
Replies
11
Views
917
makon
M
Not sure how this post went under my radar, but thanks for sharing your solution with the members.
Replies
3
Views
425
If you disable your nas firewall, then it’s opened up to everything and anything, because you have no...
Replies
24
Views
1,015

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Top