QNAP NAS SSL Certificate: Replacing the Self-Signed Certificate with Let's Encrypt or a Custom Certificate

QNAP NAS devices run QTS (or QuTS hero), which manages the web administration interface, file services, and applications like Qsync, myQNAPcloud, and others. Like Synology, QNAP ships with a self-signed certificate. This article covers replacing it with a Let’s Encrypt certificate through the built-in ACME client, uploading a custom certificate from an internal CA, and configuring the certificate to be used across QNAP applications.

Where QNAP stores TLS certificates

QNAP stores its certificate configuration in:

/etc/stunnel/stunnel.pem — legacy location (QTS 4.x)
/etc/config/stunnel/ — current location for service TLS
Certificate & Private Key Manager — the UI abstraction in QTS 5.x

The active certificate is used by:

QTS web admin interface (HTTPS on port 8443 or 443)
myQNAPcloud DDNS service
App-specific HTTPS services

Method A: Let’s Encrypt via myQNAPcloud or SSL/TLS Certificate Manager

QTS 5.x — Via SSL/TLS Certificate Manager

Open Control Panel → Security → SSL Certificate & Private Key.
Click Replace Certificate.
In the dialog, choose Get from Let’s Encrypt.
Enter:

Domain: the domain pointing to your QNAP’s IP (e.g., qnap.example.com)
Email: your email for Let’s Encrypt notifications

Click Apply.

QTS will open port 80 temporarily for the HTTP-01 challenge and request the certificate. The certificate is imported and set as the default automatically.

Requirement: Port 80 must be forwarded from your router to the QNAP device during the certificate request. After the certificate is issued, you can close port 80 again.

Via myQNAPcloud

If your QNAP is registered with myQNAPcloud and you are using a *.myqnapcloud.com hostname, the SSL certificate for that hostname is managed automatically by QNAP Cloud. No manual configuration is needed.

Method B: Uploading a custom certificate

For an internal CA certificate or a commercial certificate:

Step 1: Prepare the files

You need:

Certificate (.crt or .pem) — the full chain including intermediates
Private key (.key) — the matching private key (unencrypted)

If your certificate is in PFX format:

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in certificate.pfx -nocerts -nodes -out key.pem

Step 2: Upload via QTS Control Panel

QTS 5.x:

Open Control Panel → Security → SSL Certificate & Private Key.
Click Replace Certificate.
Choose Import certificate.
Upload:

Private key (.key file)
Certificate (.crt or .pem file)

Click Apply.

QTS 4.x (older):

Open Control Panel → Security → SSL Certificate & Private Key.
Click Replace Certificate.
Select Import certificate.
Upload the certificate and private key.
Click Apply.

QTS restarts the web server to apply the new certificate.

Method C: SSH-based manual certificate replacement

For advanced users or automated pipelines, replace the certificate files directly via SSH.

# Connect via SSH
ssh admin@qnap.example.com

# Backup current certificate
cp /etc/stunnel/stunnel.pem /etc/stunnel/stunnel.pem.bak-$(date +%Y%m%d)

# On your certificate management server, prepare the combined PEM
# QNAP expects key + certificate concatenated
cat privkey.pem fullchain.pem > combined.pem

# Copy to QNAP (from your management server)
scp combined.pem admin@qnap.example.com:/etc/stunnel/stunnel.pem

# On the QNAP, restart the web server
/etc/init.d/stunnel.sh restart
# or
/etc/init.d/Qthttpd.sh restart

Note: The exact init script names vary by QTS version. Check what is available:
ls /etc/init.d/ | grep -i "http\|ssl\|stun"

Method D: QNAP Certificate Manager API (QTS 5.x)

QTS 5.x exposes a REST API for certificate management. Automate certificate replacement in CI/CD pipelines or after Let’s Encrypt renewal:

#!/bin/bash
QNAP_HOST=https://qnap.example.com:8443
QNAP_USER=admin
QNAP_PASS="admin-password"
CERT_DIR=/etc/letsencrypt/live/qnap.example.com

# Get SID (session ID)
SID=$(curl -s -k "${QNAP_HOST}/cgi-bin/authLogin.cgi?user=${QNAP_USER}&****** '%s' "${QNAP_PASS}" | base64)" \
  | python3 -c "import sys,xml.etree.ElementTree as ET; root=ET.fromstring(sys.stdin.read()); print(root.find('authSid').text)")

echo "Session ID: $SID"

# Replace certificate via API
curl -s -k \
  -X POST "${QNAP_HOST}/cgi-bin/sslCertAdmin.cgi" \
  -F "func=replaceCert" \
  -F "sid=${SID}" \
  -F "certFile=@${CERT_DIR}/fullchain.pem" \
  -F "keyFile=@${CERT_DIR}/privkey.pem"

echo "Certificate replaced. Restarting web server..."

# Restart QNAP web server via API
curl -s -k "${QNAP_HOST}/cgi-bin/sslCertAdmin.cgi?func=restart&sid=${SID}"

# Logout
curl -s -k "${QNAP_HOST}/cgi-bin/authLogin.cgi?logout=1&sid=${SID}" > /dev/null

Configuring individual applications to use the new certificate

QNAP applications like Web Server (Apache/Nginx), FTP Server (over TLS), and LDAP Server may have their own certificate settings.

Web Server

Open Web Server in App Center.
Go to Settings → HTTPS.
The Web Server can use the system certificate (what you replaced above) or a separate certificate.
Select System Default Certificate to use the one from Control Panel.

FTP with TLS (FTPS)

Open Control Panel → Network & Virtual Switch → FTP/FTPS.
Enable FTPS.
The certificate used is the system default certificate.

myQNAPcloud

After replacing the system certificate, myQNAPcloud may need its connection re-established:

Open myQNAPcloud app.
Check SSL settings and verify the correct certificate is selected.

HTTPS redirect and port configuration

Set QTS to use HTTPS only:

Open Control Panel → System → Security → Network Access Protection.
Or navigate to Control Panel → General Settings → System Port.
Change the default HTTPS port (8443 by default, or 443 with port forwarding).
Enable Force SSL connection to redirect HTTP to HTTPS.

Let’s Encrypt renewal automation

QTS does not have a built-in certbot renewal timer, but you can automate renewal via a scheduled task:

Open Control Panel → Task Scheduler.
Create a Scheduled Task that runs monthly.
The task should call a script that:

Requests a new certificate via the HTTP-01 challenge
Uploads it via the API

Alternatively, run certbot on a separate Linux server and push the certificate to QNAP via the SSH method (Method C) or API (Method D) as a deploy hook.

# /etc/letsencrypt/renewal-hooks/deploy/qnap.sh
#!/bin/bash
QNAP_IP=192.168.1.100
CERT_DIR=/etc/letsencrypt/live/qnap.example.com
DEST=/etc/stunnel/stunnel.pem

cat ${CERT_DIR}/privkey.pem ${CERT_DIR}/fullchain.pem | \
  ssh admin@${QNAP_IP} "cat > ${DEST} && /etc/init.d/stunnel.sh restart"

echo "QNAP certificate updated"

Troubleshooting

Problem	Cause	Fix
Let’s Encrypt fails: “challenge not completed”	Port 80 not reachable	Forward port 80 in router to QNAP
Certificate upload fails	File format not PEM	Convert from DER: `openssl x509 -inform DER -out cert.pem -in cert.der`
QNAP still shows old cert after upload	Web server not restarted	Restart stunnel/Qthttpd via SSH
Mobile app shows certificate warning	App does not use system cert	Check app-specific certificate settings
“Private key does not match certificate”	Using mismatched key and cert	Verify: `openssl x509 -noout -modulus -in cert.pem \| md5sum` and `openssl rsa -noout -modulus -in key.pem \| md5sum` should match
qNAP web panel inaccessible after cert change	Corrupted or incompatible certificate installed	Restore backup via SSH: `cp stunnel.pem.bak stunnel.pem && /etc/init.d/stunnel.sh restart`

Verifying the certificate

From a workstation on the same network:

openssl s_client -connect qnap.example.com:8443 -servername qnap.example.com </dev/null 2>&1 \
  | openssl x509 -noout -subject -dates -issuer

Or open the QTS web interface in a browser and click the padlock to inspect the certificate.

Summary

QNAP TLS certificate replacement is done through Control Panel → Security → SSL Certificate & Private Key. The built-in Let’s Encrypt integration handles issuance when port 80 is reachable. For custom certificates, upload the PEM-format certificate and private key through the same interface. Applications like Web Server and FTP TLS use the system default certificate automatically. For automated renewal, push certificates to QNAP via SSH or the REST API as a certbot deploy hook. Always keep a backup of the original stunnel.pem before making changes, as a bad certificate can lock you out of the web interface.