Info Wild Card certs on Synology DDNS

[Telos]

I recall discussion stating that Synology DDNS does not support LE wildcard certs... But this recent Community post
Synology Community

suggests otherwise, showing a redacted list of Synology DDNS addresses associated with an LE cert which includes wildcard use.

Specifically...

 

[fredbert]

Thought they had brought in support of wildcards for mydevice.synology.me but not for personal domains. Can't remember if it was on DSM, SRM, both, or if my memory is failing.

 

[Rusty]

wild is supported for syno domains on dsm as of recently

 

[WST16]

This is good news. Is it only with synology.me domain or any domain provided as a choice? Anyone knows?

 

[Rusty]

Only with any synology domain they offer

 

[fredbert]

SRM seems to have current support for LE wildcard. But wasn't DSM waiting for v7?

 

[Rusty]

But wasn't DSM waiting for v7?

Hmm you are correct.

Question - LE Cert | Synology DDNS Wildcard

It's been often said that the Synology doesn't support wildcard use. I see that limit in the LE Cert tool on my NAS. Is this specific for the Synology LE Cert registration, alone, or also for the Synology DDNS domains? For example, if I manage to get the LE Cert process working on Docker, can...

www.synoforum.com

Not sure whats going on there then... Well synology.me LE certs with SAN support are def long time supported on DSM, but considering that I don't use wild via synology.me I can't say this for sure (regarding DSM).

On SRM I haven't tried to issue one considering that I have no intentions to expose anything on there or to have a cert on a device that's hidden.

 

[Telos]

Personally, this sux for me as I renewed my cert the day before stumbling across this feature.

 

[WST16]

Personally, this sux for me as I renewed my cert the day before stumbling across this feature.

On DSM 7.0?

I’m confused. So it’s supported on SRM but not the current DSM. However, it’s supported on DSM 7.0 (beta or something)?!
Is that what it is?

 

[akahan]

@fredbert, I don't think SRM has support for obtaining a wildcard LE certificate for any domain names other than Synology DDNS. If you hover your cursor over the informational "i" next to the subject alternative name field, that's what it says, anyway.

 

[fredbert]

That's what I thought from the Synology announcements and I haven't bother trying to use a different certificate than the one I setup ages ago.

 

[WST16]

So the gist of it is that no one knows what’s going on. Excellent
I left a note to self about something in this thread. Thanks.

 

[akahan]

In any case, there’s nothing to stop you from generating a wildcard cert from LE using zerossl.com, for example, and installing it on the Synology.

 

[Telos]

there’s nothing to stop you from generating a wildcard cert from LE using zerossl.com

Nice find. I was unaware of this one.

 

[akahan]

Unfortunately, within the past few days, zerossl has decided to charge a fee for an account that enables you to register wildcard LE certs.

 

[Telos]

... for $480 USD/year. Yikes!

 

[Rusty]

Yeah... no...

 

[rtfmoz]

As of DSM release 6.2.3 Synology supported wildcard certificates. However these are only supported on Synology domains because there is a technical limitation. Wildcard certificates can ONLY be verified by DNS and not by HTTP. Since Synology has no control over DNS records for customers own domains they cannot perform this DNS verification when registering for a domain through letsencrypt. But (pause) where there is a will...

For the un-initiated... In order to perform this verification you need to be able to update DNS entries using some kind of API (pfSense has extensive support for this). You need a way to request it from letencrypt (acme.sh), prove you own it (DNS API), configure DSM to use it (???) and renew it (cleanly). Some of these are difficult in a closed system like Synology.

After posting this to Synology forums I have since found that acme.sh actually has synology_dsm deployment hook to add certs into the DSM configuration. This was courtesy of this excellent blog post detailing LE wildcard certificate generation for user owned domains Automatically renew Let's Encrypt certificates on Synology NAS using DNS-01 challenge

Now in my case I am using Google DNS (not-gsuite) which has no API support at all. But all is not lost, as they introduced a new cert.sh parameter called --domain-alias. You can use a CNAME to point the proof-of-ownership DNS record _acme-challenge to a host of your choice. In this case... the DDNS name I setup under the Synology domain mystuff.synology.me. But hold on, doesn't that mean I have to now run a DNS server under DSM to answer an incoming DNS query? Well... not quite grin.

Now acme.sh supports are little thing called acme dns. This is a simple DNS server written in go language specifically for handling ACME challenges. So at this moment I am cross compiling this for my Synology then using acme.sh and --domain-alias plan to issue wildcard cert for my Google hosted domain running on my Synology DSM with auto renewal.

 

[rtfmoz]

Since posting this I have submitted a feature request to Synology to solve this issue.

Wildcard User Domains

In a nutshell, Synology can check if the user has a DNS record in their domain for _acme-challenge pointing to their Synology domain via CNAME. The user has to have already have setup Synology domain under External -> DDNS. Once that is in place they can issue a wildcard certificate for the user's domain. acmesh-official/acme.sh see domain-alias.

 

[one-eyed-king]

@rtfmoz: though, isn't the real problem that Synology did not integrate dns-api implementations, like most other Letsencrypt clients do? What makes Synology's LE client so special that its impossible to integrate it?