I have Synology NAS I am trying to apply a security certificate on for External access.
The Synology NAS is behind our corporate firewall and uses Lets Encrypt.
I have setup a rule on the Firewall to try and send incoming port 80 traffic to the NAS using a SNAT.
When we try and add a certificate we get an error saying "Please check if your IP address, reverse proxy rules and firewall settings are correctly and try again"
We have no proxy, the IP address is correct.
I have logged a call with Synology, they have suggested I speak to Lets Encrypt.
I cannot allow all incoming port 80 traffic on our Firewall as we have a zero-trust policy, I need to know either the FQDN or the IP addresses the traffic is being sent from from Lets Encrypt.
I have read you use a DNS lookup to validate the domain. Is there a DNS entry required for Lets Encrypt to validate?
The two main methods Let's Encrypt uses to validate whether you control a domain name are (1) using a TXT record in DNS to validate, called DNS-01, or (2) using DNS to look up the A/AAAA records and then using HTTP to that host, called HTTP-01.
In either event, it checks from multiple places around the world to confirm that you actually control the domain name throughout the visible Internet.
Hi Peter, thanks for replying so quickly.
I am initiating the new certificate request from a Synology NAS in its Security settings.
I don't 100% understand how this process works. It feels like I need to a TXT record to my DNS for this to work?
I'm not personally familiar with Synology, so you may need to wait for someone else who is. But there might be some way to configure it with your DNS provider and whatever API key or the like it uses, so that your system can create the needed TXT records whenever it needs a certificate.
Are you able to set your firewall to block everything arriving on port 80 except for requests for a specific path in the URL? More details of this are in this topic in the FAQ Peter linked: Multi-Perspective Validation & Geoblocking FAQ
If your firewall allows requests for multiple domain names you could further restrict these inbound ACME Challenge URL just for the domain for the NAS
Synology's implementation allows DNS-01 for Synology-provided domains, e.g. <something>.synology.me and around a dozen more. But any other custom domain names can be used only with HTTP-01. So the port 80 must be open for this scenario.
The path restriction mentioned earlier might actually be your move here — if you can configure the firewall to allow inbound port 80 only for requests to /.well-known/acme-challenge/, you'd satisfy the HTTP-01 validation without blanket port 80 access. That keeps your zero-trust policy intact while still working with custom domains. Most firewalls can do this with an allow rule that checks the URL path before the rest of your deny-all stance kicks in.