Skip to main content
Synology · acme.sh · Let's Encrypt · Cloudflare · TLS · Shell

​
Overview

DSM 7’s built-in Let’s Encrypt support only covers HTTP-01 validation, which requires port 80 open to the internet and cannot issue wildcard certificates. This project uses acme.sh with Cloudflare DNS-01 validation to issue a *.example.com wildcard certificate without opening any inbound ports, then deploys it to DSM automatically via the synology_dsm deploy hook. It also covers a dual-certificate strategy: Cloudflare Origin Certificate for orange-cloud (proxied) traffic, and the Let’s Encrypt wildcard for direct-access services such as VPN, Mail, and WebDAV.

​
Core features

  • DNS-01 validation via Cloudflare API: writes a TXT record to fulfil the ACME challenge with no ports opened
  • Single wildcard issuance (example.com + *.example.com) covers all subdomains
  • synology_dsm deploy hook pushes and reloads the certificate through the DSM Web API after each issuance or renewal
  • DSM Task Scheduler triggers acme.sh renew daily; acme.sh only acts when the certificate is within 60 days of expiry
  • Dual certificates: DSM lets you assign Origin Certificate or Let’s Encrypt per service independently

​
Deployment architecture

​
Certificate strategy

​
Quick start

1

Create a Cloudflare API Token

Cloudflare Dashboard → My Profile → API Tokens → Create Token → Custom Token.Set permissions: Zone → DNS → Edit, zone resource scoped to the target zone. Copy the token (shown only once) and the Zone ID (right-hand panel on the Dashboard overview page).
2

Install acme.sh

--nocron is required because DSM upgrades wipe non-native crontab entries. --home is required because Synology’s /root directory structure is non-standard and causes errors without it.
3

Register a Let's Encrypt account

--server letsencrypt is required. Recent acme.sh versions default to ZeroSSL.
4

Issue the wildcard certificate (staging first, then production)

5

Deploy the certificate to DSM

Confirm in DSM Control Panel → Security → Certificate that “Let’s Encrypt Wildcard” appears.
6

Set up automatic renewal via DSM Task Scheduler

Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script, scheduled daily at 03:00:
Or use scripts/renew-cert.sh from the repo. acme.sh skips renewal internally unless the certificate is within 60 days of expiry, so running daily is safe.

​
Notes

Let’s Encrypt production enforces a rate limit of 5 certificates per domain per week. Always run --test against the staging environment before the production issuance; staging has no rate limits. Use a Custom API Token with Zone DNS Edit scope only, never the Global API Key. If SYNO_CERTIFICATE contains a single quote (as in Let's Encrypt Wildcard), wrap the value in double quotes in account.conf to avoid shell quoting errors.

​
In practice

The lab NAS runs VPN, Mail, WebDAV, and Synology Drive simultaneously, all of which need a publicly trusted certificate. A single wildcard covers all subdomains with one renewal cycle. Orange-cloud services get the Origin Certificate assigned separately in DSM, leaving the Let’s Encrypt wildcard for direct-access services.