Synology DSM SSL Certificate: Replacing the Certificate and Enabling HTTPS on All Services

By /

Synology DiskStation Manager (DSM) comes with a self-signed certificate that covers the web administration interface. DSM also hosts multiple services — File Station, WebDAV, Surveillance Station, Drive, and others — all of which can use the same certificate. This article covers replacing the DSM certificate with a Let’s Encrypt or custom certificate, assigning it to all services, configuring HTTPS redirects, and automating renewal.

How DSM manages certificates

DSM stores certificates in /usr/syno/etc/certificate/ on the system partition. Each certificate set gets a UUID directory. The “default” certificate is the one automatically assigned to services that have not been given a specific certificate.

DSM versions 6.x and 7.x handle certificates differently:

  • DSM 6.x — certificates managed under Control Panel → Security → Certificate
  • DSM 7.x — same location, improved UI with ACME (Let’s Encrypt) integration

Both versions support:

  • Self-signed certificates (default, auto-generated)
  • Let’s Encrypt (ACME) certificates with automatic renewal
  • Custom certificates (uploaded PEM/PFX)

Option A: Let’s Encrypt via DSM built-in ACME

Requirements

  • Port 80 must be reachable from the internet (HTTP-01 challenge)
  • Or a supported DNS provider for DNS-01 challenge (DSM 7.x)
  • A valid domain pointing to your NAS’s public IP

DSM 7.x procedure

  1. Open Control Panel → Security → Certificate.
  2. Click Add → Add a new certificate.
  3. Select Get a certificate from Let’s Encrypt.
  4. Enter:
  • Domain name: nas.example.com
  • Email: your email address for expiry notices
  • Subject Alternative Name: additional domains (optional)
  1. Click Done.

DSM requests the certificate via the HTTP-01 ACME challenge. If successful, the certificate appears in the list.

For DNS-01 challenge (DSM 7.2+):

  1. Follow the same steps above.
  2. Check Use alternate ACME server if needed.
  3. After entering the domain, click Configure DNS to select your DNS provider (Cloudflare, Route53, etc.) and provide credentials.

Making the Let’s Encrypt certificate the default

  1. In the certificate list, select the Let’s Encrypt certificate.
  2. Click Actions → Set as Default.
  3. Click Confirm.

DSM restarts affected services automatically.

Automatic renewal

DSM’s Let’s Encrypt certificates renew automatically — DSM has a built-in renewal check that runs before expiry. No additional configuration is needed. You can verify renewal history in the system log.

Option B: Upload a custom certificate

For internal CA certificates or certificates from commercial providers:

Prepare the certificate files

You need three PEM files:

  • Private Key (privkey.pem)
  • Certificate (cert.pem or fullchain.pem)
  • Intermediate Certificate (chain.pem) — optional if already included in the certificate

For a Let’s Encrypt certificate managed externally:

# On your certificate management server
CERT_DIR=/etc/letsencrypt/live/nas.example.com

The files are at:

  • Certificate: ${CERT_DIR}/cert.pem
  • Private key: ${CERT_DIR}/privkey.pem
  • Intermediate: ${CERT_DIR}/chain.pem

Upload to DSM

  1. Open Control Panel → Security → Certificate.
  2. Click Add → Add a new certificate.
  3. Select Import certificate.
  4. Upload:
  • Private key: privkey.pem
  • Certificate: cert.pem or fullchain.pem
  • Intermediate certificate: chain.pem (if separate)
  1. Give it a descriptive name.
  2. Click OK.

Set as default

After upload, select the certificate → Actions → Set as Default.

Assigning certificates to specific services

DSM allows per-service certificate assignment. This is useful when different subdomains serve different services.

  1. Open Control Panel → Security → Certificate.
  2. Select a certificate in the list.
  3. Click Actions → Configure.
  4. A dialog shows all DSM services with their current certificate assignment.
  5. Use the dropdowns to assign each service to the desired certificate.
  6. Click OK.

Services include:

  • DSM (web administration)
  • Synology Drive
  • File Station
  • Surveillance Station
  • Audio Station
  • Video Station
  • WebDAV
  • Mail Server (if installed)
  • Reverse Proxy entries

Forcing HTTPS for DSM web access

  1. Open Control Panel → Network → DSM Settings.
  2. Check Automatically redirect HTTP connections to HTTPS.
  3. Click Apply.

This adds a 301 redirect from port 5000 (HTTP) to port 5001 (HTTPS) in the DSM nginx configuration.

Enabling HSTS

For DSM 7.x:

  1. Open Control Panel → Security → Security.
  2. Under HTTP Strict Transport Security (HSTS), enable it.
  3. Set the Max-age (recommended: 1 year = 31536000 seconds).
  4. Click Apply.

Using a wildcard certificate for multiple services

A wildcard certificate (*.example.com) from your internal CA or a commercial provider can cover all Synology services (nas.example.com, drive.example.com, etc.) with a single certificate.

Import the wildcard certificate as a custom certificate (Option B above). Then in the service configuration, assign it to all services.

Automating certificate renewal via the DSM API

For certificates managed by an external system (like certbot on a separate server), push new certificates to DSM via its API:

#!/bin/bash
# Push a renewed certificate to Synology DSM via API

DSM_HOST=https://nas.example.com:5001
DSM_USER=admin
DSM_PASS="admin-password"
CERT_ID="your-cert-id"  # Found in DSM API or URL when editing cert

CERT_DIR=/etc/letsencrypt/live/nas.example.com

# Get an API session
SID=$(curl -s "${DSM_HOST}/webapi/auth.cgi?api=SYNO.API.Auth&version=3&method=login&account=${DSM_USER}&passwd=${DSM_PASS}&session=Certificate&format=sid" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['sid'])")

# Upload the new certificate
RESPONSE=$(curl -s -X POST "${DSM_HOST}/webapi/entry.cgi" \
  -F "api=SYNO.Core.Certificate.CRT" \
  -F "method=import" \
  -F "version=1" \
  -F "_sid=${SID}" \
  -F "id=${CERT_ID}" \
  -F "key=@${CERT_DIR}/privkey.pem" \
  -F "cert=@${CERT_DIR}/cert.pem" \
  -F "intermediate_cert=@${CERT_DIR}/chain.pem")

echo "Certificate update response: $RESPONSE"

# Logout
curl -s "${DSM_HOST}/webapi/auth.cgi?api=SYNO.API.Auth&version=1&method=logout&session=Certificate&_sid=${SID}" > /dev/null

Make this a certbot deploy hook:

sudo nano /etc/letsencrypt/renewal-hooks/deploy/synology.sh
#!/bin/bash
# Call the DSM API script
bash /usr/local/bin/push-cert-to-synology.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/synology.sh

DSM Reverse Proxy with custom TLS

DSM 7.x includes a built-in reverse proxy that can handle TLS for internal services:

  1. Open Control Panel → Login Portal → Advanced → Reverse Proxy.
  2. Click Create.
  3. Fill in:
  • Source Protocol: HTTPS
  • Source Hostname: your domain (e.g., app.example.com)
  • Source Port: 443
  • Destination Protocol: HTTP
  • Destination Hostname: the internal service IP
  • Destination Port: the internal port
  1. Click Custom Header to add security headers.
  2. Save.

The reverse proxy uses the certificate assigned to DSM by default. You can assign a different certificate under the Certificate configuration.

Certificate file locations (for advanced troubleshooting)

If you need to inspect or manually replace DSM certificate files:

# SSH into the Synology NAS
ssh admin@nas.example.com

# List all certificate directories
ls /usr/syno/etc/certificate/

# The "default" symlink points to the active certificate
ls -la /usr/syno/etc/certificate/_archive/

# Certificate files inside each UUID directory:
# cert.pem, chain.pem, fullchain.pem, privkey.pem, info

Do not manually edit these files unless you know what you are doing — DSM may overwrite them, and incorrect changes can break web access.

To reload DSM’s nginx after manual file changes:

sudo synoservicecfg --reload nginx

Troubleshooting

ProblemCauseFix
Let’s Encrypt fails: “Domain is not reachable”Port 80 blocked or DNS not pointing to NASOpen port 80 in router/firewall; verify DNS
Certificate not showing in service listCertificate upload failedCheck format — must be PEM, not DER
Browser still shows old cert after renewalBrowser caching or DSM needs service restartForce refresh; restart services in Control Panel
Mobile apps show certificate errorCertificate not trusted (self-signed or custom CA)Install CA certificate on mobile device
HTTPS redirect loopsBoth ports 5000 and 5001 serve different certsEnsure default cert covers the hostname used
Synology Drive shows certificate warningDrive service assigned to different certificateIn Certificate → Configure, set Drive to use the correct cert

Summary

DSM certificate management is done in Control Panel → Security → Certificate. The built-in Let’s Encrypt integration handles issuance and renewal automatically when port 80 is reachable. For custom or internal CA certificates, use the Import option and upload PEM files. Set the correct certificate as default and use the Configure dialog to assign it to all services including Synology Drive and the reverse proxy. Enable HTTPS redirect in Control Panel → Network → DSM Settings to prevent accidental HTTP access.

Related Posts

Scroll to Top