Installing SSL certificates on a Synology NAS

steven · Post by **steven** » Wed Jun 29, 2022 11:08 am

Synology has an easy method to install certificates. I have found this method easier to use and certificates are not affected by upgrades, as can happen if you place them in the wrong place during a manual installation. Note these instructions apply to certificates you purchase from a third party vendor. If you are renewing a self-signed certificate, simply right click the certificate a click to renew.

To install a new certificate you must create a CSR (certificate signing request). The request will contain your domain name, location, an encrypted key matching your encrypted server key and other site information required to obtain a SSL certificate.

Log in to you NAS and select control panel, then select Security.

At the top, select the Certificate tab.

On this screen select Settings.

When the popup screen appears select Advanced and then select Ok.

Click the Create certificate signing request (CSR) button.

On this screen populate the information required to create the CSR.

Private key length - 2048 (generates 256bit encryption keys)

Common name - This must match the reqistered domain name.
For example if your domain name is www.example.com, and you use example.com the site will not be secure and you will get a warning when visiting the site. The domain name and common name must match exactly.
Some certificates support both www and non www domains. Verify this with your SSL vendor before creating the CSR.

Email - This is the email address that is registered to the domain.

State/Province - This is the location used for the mailing address.

City - This is the city name used for the mailing address.

Organization - The name of your company. If you do not have a company you can use a name like the domain minus the extension.

Department - This is a department within your company. If you do not have a company department you can use marketing, sales, research etc.

After populating these fields click next.

Select download to save your CSR.

The saved file is named archive.zip and contains two files.

The first file is server.csr which contains the code for the certificate signing request. The contents of this file is pasted into the certificate vendors web page form or sent to the certificate vendor you have chosen.

The second file is server.key and contains a unique key for your server. DO NOT send this file to the certificate vendor or anyone else.

Depending on the type of certificate you purchased, it can take a few minutes or sometimes longer to email your certificate. You may be required to respond to an email or a more detailed method to verify site ownership. Your domain must be registered before a third party certificate is issued.

Once you receive the new SSL certificate, you must create three files. The first is the server certificate which we will name cert.pem. Your SSL vendor may or may not include information defining each section. If they included that information, follow their directions.
Using Notepad++ or another text editor, open the certificate file you received from the SSL vendor. The file will contain at least two sections. The first section is the server certificate. Make sure you include the beginning and ending line statements.

Copy ALL information in this first section and paste it into the text editor. Then save the file as cert.pem.

The next section is the intermediate certificate. Depending on how the certificate is issued, the intermediate or CA chain may have additional sections. If the vendor's SSL certificate file has more than two sections the second section is the intermediate certificate and the third section is usually the CA root certificate. Online articles have different opinions about installing the root certificate. Some recommend installing the root certificate. However it is not necessary if you are using a trusted CA vendor. To learn more about certificates, KEYFACTOR provides some good general information. To learn specific information about TLS (Transport Layer Security), please refer to the TLS Standard.

To install the intermediate certificate copy the second section to the text editor including the beginning and ending line statements. Then save the file as chain.pem.

The example below shows the file content to install the intermediate certificate.

A CA root certificate is not required unless you are using a custom certificate that may not be listed in the certificate trust store. In this case you will need to install the CA root certificate to allow users to connect securely. If your SSL certificate requires including the CA root certificate, copy both the second and third sections to the text editor including the beginning and ending line statements. Then save the file as chain.pem.

The example below shows the file contents to install both the intermediate and CA root certificates.

Last open the server.key file created when you generated the CSR. Copy and rename this file to privkey.pem. Once these files are created move them, along with the original CSR file, into a secure folder on a local drive and make sure you add a text info file so you know the domain they are for along with the creation date. If you add multiple certificates, this will help identify the certificate should you need to replace it.

Install the certificate files on your NAS as follows:
Open the control panel and select security and then select certificate.
Select Add.

If you are not replacing an existing certificate, select Add new certificate. This creates a new certificate in addition to any existing certificates you may have.

If you are replacing an existing certificate select Replace an exiting certificate. This will transfer configuration settings for the existing certificate to the new certificate. DO NOT forget to select the certificate you want to replace because the certificate shown in the box will be replaced. If you select the wrong certificate there is no UNDO and you will have to reinstall the certificate that was overwritten.
Select Next.

Here you add a description and have the option to make the SSL certificate the default. The default certificate is assigned to new web service portals.
Since you already created the necessary files click Next to start importing the new certificate.

Select next and the import certificate window appears.

On the Private key line select Browse. This opens your file explorer so you can locate and select the privkey.pem file you saved earlier.

On the Certificate line select Browse. Locate and select the cert.pem file you saved earlier.

On the Intermediate certificate line select Browse. Locate and select the chain.pem file you saved earlier.

Once all fields are populated select OK.

After few seconds, if you performed all operations correctly, the certificate will install. If it does not install and you get an error, check the cause of the error and if necessary, recreate the three PEM files making sure you are using the correct code for each file. If the error is the intermediate certificate and there are two sections, they may need to be reversed. (I did not have to reverse them when I installed certificates)

Once the certificate is installed you can go to settings and configure the new certificate. If you replaced a certificate you do not need to do anything as it will show the certificate attached to that domain.

Last you can verify the certificate is installed correctly using an online checker like Qualys SSL Checker, which gives the best information.
You can also use SSL Certificate Checker or Ionos SSL checker.
If the root certificate is not installed and the CA is trusted, SSL Certificate Checker will not display an error but indicates the root certificate is missing. This occurs because SSL Certificate Checker does check the trust store.
If the root certificate is not installed and the CA is trusted Ionos SSL checker displays the certificate was installed correctly. However, if the root certificate is installed and the CA authority is trusted, Ionos will display a warning: "For best practices, remove the self-signed root from the server."

Remember it is the user's browser that accepts or rejects the SSL certificate so make sure you obtain your certificate from a trusted CA authority.