Do I need to expose DSM to the internet to get a certificate?

Not with DNS-01. acme.sh validates through your DNS provider's API, so the NAS can stay reachable only on your LAN or VPN while still presenting a publicly trusted certificate for nas.example.com.

Why does the browser still warn after I installed the certificate?

Either you are connecting by IP address or a name not on the certificate, or the service is still mapped to the old self-signed certificate. Open Certificate → Settings and assign the new certificate to the service you use.

Is SYNO_USE_TEMP_ADMIN safe?

It lets the deploy hook create a short-lived admin user locally instead of storing your admin password in acme.sh's configuration. It only works when acme.sh runs on the NAS itself, not in Docker or on another host.

Synology NAS SSL: Let's Encrypt in DSM, or acme.sh with DNS

A Synology NAS gets a publicly trusted Let's Encrypt certificate for nas.example.com in one of two ways: DSM's built-in Let's Encrypt support when port 80 is open, or acme.sh with DNS validation when it is not. Both renew automatically, and DSM services use the certificate once you assign it.

The steps apply to DSM 7.2 and later; menu names follow the Synology Knowledge Center.

Prerequisites

Pick the path that matches your network.

A Synology NAS on DSM 7.2 or later, and an administrator account.
A domain or subdomain such as nas.example.com with an A record pointing at your public IP (for example 203.0.113.10), or a synology.me DDNS hostname.
For DSM's built-in Let's Encrypt: TCP port 80 on the router forwarded to the NAS.
For acme.sh: SSH enabled (Control Panel → Terminal & SNMP) and a DNS provider API token; no inbound ports needed.

Step 1: Get a certificate in DSM (port 80 open)

Go to Control Panel → Security → Certificate → Add → Add a new certificate → Get a certificate from Let's Encrypt. Enter nas.example.com as the domain name, an email address, and any subject alternative names, then click Done. DSM validates over port 80 and installs the certificate.

With a synology.me hostname, you can instead go to Control Panel → External Access → DDNS, add or edit the Synology DDNS entry, and enable the option to get a Let's Encrypt certificate and set it as default.

Step 2 (alternative): Issue with acme.sh and DNS-01 (port 80 closed)

SSH into the NAS and become root, then install acme.sh into a persistent location without its own cron job:

sudo -i
cd /tmp
curl -L -o acme.sh.tar.gz https://github.com/acmesh-official/acme.sh/archive/refs/heads/master.tar.gz
tar -xzf acme.sh.tar.gz && cd acme.sh-master
./acme.sh --install --nocron --home /usr/local/share/acme.sh -m admin@example.com

Issue the certificate through your DNS provider's API (Cloudflare shown; see acme.sh DNS API for others):

export CF_Token="your-cloudflare-api-token"
export CF_Zone_ID="your-zone-id"
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --set-default-ca --server letsencrypt
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --issue --dns dns_cf -d nas.example.com

The acme.sh wiki has a Synology-specific page; follow it if your DSM version needs different paths.

Step 3: Deploy the certificate into DSM

Use the synology_dsm deploy hook with a temporary admin user (works when acme.sh runs on the NAS):

export SYNO_USE_TEMP_ADMIN=1
export SYNO_CREATE=1
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --deploy -d nas.example.com --deploy-hook synology_dsm

SYNO_CREATE=1 is needed for the first deployment. acme.sh remembers the hook and runs it after each renewal.

Step 4: Assign the certificate to services

In Control Panel → Security → Certificate, select the new certificate and click Set as default certificate if you want it everywhere, then open Settings and map each service (DSM, Synology Photos, WebDAV and so on) to it.

Verify

DSM should serve the Let's Encrypt certificate for nas.example.com on its HTTPS port, 5001. Check it with OpenSSL:

openssl s_client -connect nas.example.com:5001 -servername nas.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

If the NAS (or a reverse proxy on it) is reachable on port 443, use the SSL checker, or from any terminal:

curl ssl.sh/nas.example.com

Automatic renewal

DSM renews certificates it obtained from Let's Encrypt on its own, as long as port 80 stays forwarded and DNS still points at your IP. For acme.sh, schedule renewal in Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script, user root, daily, with this command:

/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh

acme.sh follows Let's Encrypt's ARI window (3.1.4+) and re-runs the synology_dsm hook after each renewal. Let's Encrypt's default lifetime falls to 64 days on February 10, 2027 and 45 days on February 16, 2028, so a daily task is the right cadence. If the NAS is reachable from outside, add it to ssl.sh monitoring (in development).

Troubleshooting

DSM reports that Let's Encrypt could not connect: port 80 is not forwarded, the ISP blocks it, or DNS points elsewhere; the causes match certbot timeout during connect. Use the acme.sh path instead.
Browser still shows the Synology self-signed certificate: the service is mapped to the old certificate; see NET::ERR_CERT_AUTHORITY_INVALID.
Name mismatch: you connect via IP or a QuickConnect address; use nas.example.com, see NET::ERR_CERT_COMMON_NAME_INVALID.
synology_dsm deploy fails with a login error: temp admin only works on the NAS itself; for remote deploys set SYNO_USERNAME, SYNO_PASSWORD, SYNO_HOSTNAME and related variables as described in the acme.sh wiki.
Renewal stopped after a DSM update: confirm the Task Scheduler entry still exists and the acme.sh folder is intact.

How to set up a Let's Encrypt certificate on a Synology NAS