# Synology NAS SSL: Let's Encrypt in DSM, or acme.sh with DNS

> Get a trusted certificate for a Synology NAS: DSM built-in Let's Encrypt (port 80), synology.me DDNS, or acme.sh DNS-01 with the synology_dsm hook.

Source: https://ssl.sh/guides/synology-nas-ssl/
Last updated: 2026-11-10

A Synology NAS gets a publicly trusted Let's Encrypt certificate for `nas.example.com` in one of two ways: DSM's built-in Let's Encrypt support when port 80 is open, or acme.sh with DNS validation when it is not. Both renew automatically, and DSM services use the certificate once you assign it.

The steps apply to DSM 7.2 and later; menu names follow the Synology Knowledge Center.

## Prerequisites

Pick the path that matches your network.

- A Synology NAS on DSM 7.2 or later, and an administrator account.
- A domain or subdomain such as `nas.example.com` with an `A` record pointing at your public IP (for example `203.0.113.10`), or a synology.me DDNS hostname.
- For DSM's built-in Let's Encrypt: TCP port 80 on the router forwarded to the NAS.
- For acme.sh: SSH enabled (Control Panel → Terminal & SNMP) and a DNS provider API token; no inbound ports needed.

## Step 1: Get a certificate in DSM (port 80 open)

Go to **Control Panel → Security → Certificate → Add → Add a new certificate → Get a certificate from Let's Encrypt**. Enter `nas.example.com` as the domain name, an email address, and any subject alternative names, then click **Done**. DSM validates over port 80 and installs the certificate.

With a synology.me hostname, you can instead go to **Control Panel → External Access → DDNS**, add or edit the Synology DDNS entry, and enable the option to get a Let's Encrypt certificate and set it as default.

## Step 2 (alternative): Issue with acme.sh and DNS-01 (port 80 closed)

SSH into the NAS and become root, then install acme.sh into a persistent location without its own cron job:

```bash
sudo -i
cd /tmp
curl -L -o acme.sh.tar.gz https://github.com/acmesh-official/acme.sh/archive/refs/heads/master.tar.gz
tar -xzf acme.sh.tar.gz && cd acme.sh-master
./acme.sh --install --nocron --home /usr/local/share/acme.sh -m admin@example.com
```

Issue the certificate through your DNS provider's API (Cloudflare shown; see [acme.sh DNS API](https://ssl.sh/guides/acme-sh-dns-api-wildcard/) for others):

```bash
export CF_Token="your-cloudflare-api-token"
export CF_Zone_ID="your-zone-id"
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --set-default-ca --server letsencrypt
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --issue --dns dns_cf -d nas.example.com
```

The acme.sh wiki has a Synology-specific page; follow it if your DSM version needs different paths.

## Step 3: Deploy the certificate into DSM

Use the `synology_dsm` deploy hook with a temporary admin user (works when acme.sh runs on the NAS):

```bash
export SYNO_USE_TEMP_ADMIN=1
export SYNO_CREATE=1
/usr/local/share/acme.sh/acme.sh --home /usr/local/share/acme.sh \
  --deploy -d nas.example.com --deploy-hook synology_dsm
```

`SYNO_CREATE=1` is needed for the first deployment. acme.sh remembers the hook and runs it after each renewal.

## Step 4: Assign the certificate to services

In **Control Panel → Security → Certificate**, select the new certificate and click **Set as default certificate** if you want it everywhere, then open **Settings** and map each service (DSM, Synology Photos, WebDAV and so on) to it.

## Verify

DSM should serve the Let's Encrypt certificate for `nas.example.com` on its HTTPS port, 5001. Check it with OpenSSL:

```bash
openssl s_client -connect nas.example.com:5001 -servername nas.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates
```

If the NAS (or a reverse proxy on it) is reachable on port 443, use the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal:

```bash
curl ssl.sh/nas.example.com
```

## Automatic renewal

DSM renews certificates it obtained from Let's Encrypt on its own, as long as port 80 stays forwarded and DNS still points at your IP. For acme.sh, schedule renewal in **Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script**, user `root`, daily, with this command:

```bash
/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh
```

acme.sh follows Let's Encrypt's ARI window (3.1.4+) and re-runs the `synology_dsm` hook after each renewal. Let's Encrypt's default lifetime falls to 64 days on February 10, 2027 and 45 days on February 16, 2028, so a daily task is the right cadence. If the NAS is reachable from outside, add it to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).

## Troubleshooting

- **DSM reports that Let's Encrypt could not connect**: port 80 is not forwarded, the ISP blocks it, or DNS points elsewhere; the causes match [certbot timeout during connect](https://ssl.sh/errors/certbot-timeout-during-connect/). Use the acme.sh path instead.
- **Browser still shows the Synology self-signed certificate**: the service is mapped to the old certificate; see [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/).
- **Name mismatch**: you connect via IP or a QuickConnect address; use `nas.example.com`, see [NET::ERR_CERT_COMMON_NAME_INVALID](https://ssl.sh/errors/net-err-cert-common-name-invalid/).
- **synology_dsm deploy fails with a login error**: temp admin only works on the NAS itself; for remote deploys set `SYNO_USERNAME`, `SYNO_PASSWORD`, `SYNO_HOSTNAME` and related variables as described in the acme.sh wiki.
- **Renewal stopped after a DSM update**: confirm the Task Scheduler entry still exists and the acme.sh folder is intact.