Let's Encrypt Certificate

[tekguru]

Guys I'm forwarding ports 80 & 443 on to the NAS, but I'm getting the following. Any ideas?

 

[Rusty]

Registering a non-synology domain (are you going via for a wild card cert?) you will need to configure specific settings on your domain registration to get a LE cert out.

In this article - Let's Encrypt + Docker = wildcard certs there is a Getting a 3rd party domain wild card cert using Synology UI and Cloudflare section on the bottom, how this would work if your custom domain is being handled by Cloudflare.

There are steps that need to be done and one TXT record that also needs to be valid and exist in your DNS registry for your domain.

Also, for more info on the error (if there will be some more text that is) you could go via SSH into var/log/messages file and do a cat command on it. Then review in detail whats going on.

 

[tekguru]

I'm not sure if that solution would work for me. The domain I use is ties in with my Office 365 account and all DNS records are therefore hosted by Microsoft for that to work. That being the case would I have to buy a commercial certificate?

 

[Rusty]

I'm not sure if that solution would work for me. The domain I use is ties in with my Office 365 account and all DNS records are therefore hosted by Microsoft for that to work. That being the case would I have to buy a commercial certificate?

For LE cert you do have to have specific settings in place and be sure that you own the root domain, yes. Same reason that when you do this process for *.synology.me domain, it works just fine for a device that runs DSM. Synology has all in place that allows for the generation of LE certificates for all subdomain under their DDNS ownership.

I think (but maybe someone will correct me) you will not be able to pull this off for a scenario you are going for.

 

[tekguru]

I think (but maybe someone will correct me) you will not be able to pull this off for a scenario you are going for.

Yep, that i what I'm thinking alas.....

 

[Gerard]

I'm not exactly sure what you're looking to do, but here is my experience with that error.

Use a subdomain to register the LE certs. In my setup mydomain.com is hosted by google domains. Mydomain.com lands on a website hosted by google websites. I then used google DDNS in synology, address is DDNS.mydomain.com. On my domain account this is setup as an A record. I then created a subdomain (CNAME) called DSM.mydomain.com which points to DDNS.mydomain.com.

I am then able to create a LE cert Domain = DSM.mydomain.com, my email address, and if you want add in SAN names, including DDNS.mydomain.com. Anytime I need to create an additional domain name related to the synology, I just use a new subdomin.mydomain.com in the domain name portion of LE and works without issue.

In my case when I first started (and thanks to @Rusty for all his support), I was getting the same error. Turns out I was using mydomain.com under domain name, but that was wrong since it technically points to a hosted google site (technically the verification is that google has possession of this domain name and uses their own cert for the root domain). Since realizing that, I have been using subdomain.mydomain.com names in the domain name field of LE and it has been flawless.

 

[tekguru]

Okay for me I don't have a site at mydomain.com at all, the domain was originally bought for email purposes only.

In the DS918+ I use Synology DDNS which points to MYDOMAIN.synology.me.

On the domain account I've only created CNAME records which are: myforum & mynas which both point to MYDOMAIN.synology.me

So if I understand you correctly I need to:

• Create two new A records for myforum & mynas (name = @, and point to MYDOMAIN.synology.me), or do I use myforum & mynas as the name?
• Create a LE cert Domain of mynas.mydomain.com, add SAN names of myforum
• OR is it create a LE cert Domain of mydomain.com, add SAN names of mynas & myforum

Any clarification appreciated.

 

[Rusty]

Create two new A records for myforum & mynas

CNAME towards your DDNS name would do.

OR is it create a LE cert Domain of mydomain.com, add SAN names of mynas & myforum

if you can, this, if not then option 2

 

[tekguru]

Okay.... I'll leave the DNS settings as they are for the moment. Just tried to get a cert again from LE. Data put in:

• Domain name: MYDOMAIN.COM
• Email: domain based email
• Subject Alternative name: mynas.MYDOMAIN.COM;myforum.MYDOMAIN.COM

It still fails with the error message of 'Failed to connect to Let's Encrypt. Please make sure the domain name is valid.' again.

Tried again with:

• Domain name: mynas.MYDOMAIN.COM
• Email: domain based email
• Subject Alternative name: myforum.MYDOMAIN.COM

Wow that worked! So I now have three certificates installed:

• MYDOMAIN.synology.me (default)
• synology.com
• mynas.MYDOMAIN.COM (also holds myforum.MYDOMAIN.COM)

I've changed them to be:

• MYDOMAIN.synology.me
• synology.com (synology DDNS Certificate)
• mynas.MYDOMAIN.COM (default)

Which looks good, but if I access the NAS via https://mynas.MYDOMAIN.COM I still get a not secure error and the certificate still shows as MYDOMAIN.synology.me....... I've cleared the cache on the browser, no change. I've tried it in 3 browsers (Brave, Safari & Edge) they all report the same.

What am I missing?

 

[Gerard]

• Domain name: MYDOMAIN.COM
• Email: domain based email
• Subject Alternative name: mynas.MYDOMAIN.COM;myforum.MYDOMAIN.COM

It still fails with the error message of 'Failed to connect to Let's Encrypt. Please make sure the domain name is valid.' again.

I believe this is failing because mydomain.com isn’t associated anywhere with your nas. Is mydomain.com being used for the email? If not, if you create a reverse proxy mydomain.com which then forwards to your nas, then do the LE cert as stated.

Mynas.mydomain.com works because that url is associated with your nas ( cname name record is pointing to it)

Wow that worked! So I now have three certificates installed:

• MYDOMAIN.synology.me (default)
• synology.com
• mynas.MYDOMAIN.COM (also holds myforum.MYDOMAIN.COM)

I've changed them to be:

• MYDOMAIN.synology.me
• synology.com (synology DDNS Certificate)
• mynas.MYDOMAIN.COM (default)

When you configure the certs, don’t use the synology.com one at all. Change it to either your domain or synology.me. If you plan on accessing nas with synology.me domain, make sure that domain name is what the LE is attached to. If le attached (configured) to mynas.domain.com and your using the synology.me domain you’ll get the error. Alternatively if you want to use mynas.mydomain.com to access the nas make sure the LE cert is configured for that domain name then and not synology.me.

Whatever domain name you decide to pick to access your nas, make sure you select the LE cert that matches that domain name and that it is configured for the same

Keep the synology.me cert associated with the synology.me domain name.

 

[tekguru]

Well good news since I last posted the mynas.MYDOMAIN.COM has decided to show the right certificate so maybe it took a few minutes for it to propagate through the system.

• The mynas.MYDOMAIN.COM is set to work with mynas.MYDOMAIN.COM, forum.MYDOMAIN.COM, phpBB3, FTPS, System Default and Synology Drive Server.
• The MYDOMAIN.synology.me certificate is used for MYDOMAIN.synology.me
• The synology.com certificate is there but not allied to anything.

So I think all is good

I assume that the certificates will all auto-renew and I don't need to worry about that ?

 

[Gerard]

I assume that the certificates will all auto-renew and I don't need to worry about that ?

Correct

 

[tekguru]

Brilliant so I've now get to get phpBB3 working with HTTPS and I'll be a very happy man.

Thanks to everyone for assisting in solving the problem. Love this forum!

 

[Telos]

Love this forum!

https://www.synoforum.com/account/upgrades

 

[tekguru]

If I had the spare money........ as I was forced into retirement early funds are not that good.....

 

[Rusty]

Building quality topics and thread is all we need. Thanks to all subscribers here, but donations are optional. Saying that I think Telos deserves a cookie for this

/hands some to @Telos

 

[tekguru]

Well I may not post often but hopefully what I do post may be of use to others. I may nor be that technical (docker etc, shudder), but I'm not bad on some things
Defo on the cookie