# Error connection new cert Synology **URL:** \ **Category:** Help\ **Created:** [January 1, 2021, 3:30pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748 "2021-01-01T15:30:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 1, 2021, 3:30pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/1 "2021-01-01T15:30:18Z")
Hello! First of all thank you very much for the support. Sorry to create another thread on the same topic, but after reading some time in the community I have not found a solution to my problem. Before detailing my assembly, I would like to explain it, I have a nas unit mounted behind two routers, the one from the internet company in bridge mode -innbox g64- and a -tplink archer c1200- working as a router. The case is that the WAN has dynamic ip and I have created a subdomain with cname that points to a ddns service (duckdns) Previously I tried it with the tplink ddns service until thanks to another community thread I could read that they offer a nefarious service that cannot be used, so I decided to change to the duckdns service that I read success stories with this ddns provider. But I can't do it in nas, I always get a let'sencrypt connection error with the domain, I can assure that I have the ports open and redirected, I can access it from the outside without problems and that I have tried to review the solutions offered in others community threads, but I can't get it to finish correctly. I have even come to understand a little how the [https://check-your-website.server-daten.de](https://check-your-website.server-daten.de) tool works, seeing in my case that it creates the certificates but in the unit it always gives me that error until the limit reaches of requests Well without lengthening more I detailed my assembly: My domains are: My main domain is: [rodriguezcaroabogados.com](http://rodriguezcaroabogados.com) But as I have detailed previously for this process I have created a subdomain (CNAME) that points towards a ddns service (duckdns) which would be the important ones for the case: My main subdomain is: **[intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com)** My ddns service domain is: **[rcaintranet.duckdns.org](http://rcaintranet.duckdns.org)** I ran this command: Create a new certificate NAS: Security / Certificates panel. I am asked to fill in the following details. Domain Name: [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com/) Email: [servidor@rodriguezcaroabogados.com](mailto:servidor@rodriguezcaroabogados.com) Subject Alternative Name: [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org/) It produced this output: The error I get when I click on Next is "Failed to connect to Let's Encrypt. Please make sure the domain name is valid" The operating system my web server runs on is (include version): Nas Synology DSM 6.2.3-25426 Update 3 I would like to receive help to avoid having to continue wasting the resource of being able to create certificates that end in an error and not being able to use them **Checks** Letsdebug ok: [https://letsdebug.net/intranet.rodriguezcaroabogados.com/404067](https://letsdebug.net/intranet.rodriguezcaroabogados.com/404067) Verified access from outside Ports opened and redirected correctly to nas ports, tested on [https://www.yougetsignal.com/tools/open-ports/](https://www.yougetsignal.com/tools/open-ports/) (80 open, 443 open) I appreciate some errors in the [https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com](https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com) tool, but I can't understand them, if someone can help me, I appreciate it. Happy New Year ❤ ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [January 1, 2021, 4:03pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/2 "2021-01-01T16:03:59Z")
Hi @Maguila > [@Maguila](#): > > I appreciate some errors in the [https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com](https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com) tool you have created two certificates (see the CT-log part): | Issuer | not before | not after | Domain names | LE-Duplicate | next LE | | --- | --- | --- | --- | --- | --- | | R3 | 2020-12-22 | 2021-03-22 | [autodiscover.rodriguezcaroabogados.com](http://autodiscover.rodriguezcaroabogados.com), [cpanel.rodriguezcaroabogados.com](http://cpanel.rodriguezcaroabogados.com), [cpcalendars.rodriguezcaroabogados.com](http://cpcalendars.rodriguezcaroabogados.com), [cpcontacts.rodriguezcaroabogados.com](http://cpcontacts.rodriguezcaroabogados.com), [mail.rodriguezcaroabogados.com](http://mail.rodriguezcaroabogados.com), [rodriguezcaroabogados.com](http://rodriguezcaroabogados.com), rodriguezcaroabogados.pelazoh.es, [webdisk.rodriguezcaroabogados.com](http://webdisk.rodriguezcaroabogados.com), [webmail.rodriguezcaroabogados.com](http://webmail.rodriguezcaroabogados.com), [www.intranet.rodriguezcaroabogados.com](http://www.intranet.rodriguezcaroabogados.com), [www.rodriguezcaroabogados.com](http://www.rodriguezcaroabogados.com), www.rodriguezcaroabogados.pelazoh.es - 12 entries | | | | R3 | 2020-12-22 | 2021-03-22 | [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com), [www.intranet.rodriguezcaroabogados.com](http://www.intranet.rodriguezcaroabogados.com) - 2 entries | | | One is a cPanel with your 50.87 - ip, the other is a Letsencrypt with two domain names. But the small certificate isn't used, instead, a Synology standard certificate is used. That | Host | Type | IP-Address | is auth. | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | --- | | [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com) | CNAME | [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org) | yes | 1 | 0 | | | A | 185.67.107.194 Arcos de la Frontera/Andalusia/Spain (ES) - Onlycable Comunicaciones S.L. Hostname: 194-107-67-185-red-servicios.onlycable.es | yes | | | | [www.intranet.rodriguezcaroabogados.com](http://www.intranet.rodriguezcaroabogados.com) | A | 50.87.176.241 Provo/Utah/United States (US) - UNIFIEDLAYER-AS-1 Hostname: [box2318.bluehost.com](http://box2318.bluehost.com) | yes | 1 | 0 | | | AAAA | | yes | | | may be part of the problem. Your non-www and www have different ip addresses. First step: Remove the www A record and create a CNAME www -\> non-www. Or remove the www dns entry complete. Looks like you have created the correct certificate, but the Synology client can't install it because the www version has another ip address. So it's not a certificate creation problem, it's a certificate installation problem. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 2, 2021, 12:21am UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/3 "2021-01-02T00:21:58Z")
You should be able to follow this online guide: > **[Install a Let's Encrypt SSL certificate on a Synology NAS - Mike Tabor](https://miketabor.com/install-a-lets-encrypt-ssl-on-a-synology-nas/#:~:text=How%20to%20install%20a%20Let%E2%80%99s%20Encrypt%20SSL%20on,Set%20as%20default%20certificate%20%E2%80%9D%20More%20items...%20)** > > How to install a Let's Encrypt SSL on a Synology NAS. Let's Encrypt offers a FREE and automated way to install a SSL certificate, which offers better security when your Synology NAS is publicly available. [just be sure to use the domain name: `intranet.rodriguezcaroabogados.com`] ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 6:59pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/4 "2021-01-11T18:59:15Z")
Hello! Thank you very much for the support. @JuergenAuer @rg305 Sorry for the wait, but I have to request the changes from a third person. I have opted for the option of remove the www dns entry complete, having already made the changes, I keep getting the error... "Failed to connect to Let's Encrypt. Please make sure the domain name is valid" @rg305 That was one of the guides I used to use my own subdomain and see how it was configured, but still I can't get it to finish correctly It ends up giving me the same error. I have tried to change the connection method to start the process, using the lan ip or doing it through the subdomain, but it also ends up failing. I have also tried without filling in the subject alternative name ([rcaintranet.duckdns.org](http://rcaintranet.duckdns.org)), it also ends up failing with the same error. Do you have any other ideas? [https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com](https://check-your-website.server-daten.de/?q=intranet.rodriguezcaroabogados.com) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 8:01pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/5 "2021-01-11T20:01:13Z")
> [@Maguila](#): > > I have opted for the option of remove the www dns entry complete Are you using the name: > [@rg305](#): > > [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com) OR > [@Maguila](#): > > [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org) What name do you put into the NAS? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 8:06pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/6 "2021-01-11T20:06:59Z")
A few thoughts... - You've clearly managed to generate some certificates (some or all of which appear to be for cPanel) > **[crt.sh | rodriguezcaroabogados.com](https://crt.sh/?Identity=rodriguezcaroabogados.com&deduplicate=Y)** - I see this: ```auto intranet.rodriguezcaroabogados.com. 14399 IN CNAME rcaintranet.duckdns.org. rcaintranet.duckdns.org. 59 IN A 185.67.107.194 ``` Is your website content at the address pointed to by duckdns? Normally such a CNAME would be used for dns-01 challenges for delegating TXT records, not for http-01 challenges delegating A records (and thus entire websites) ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 8:22pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/8 "2021-01-11T20:22:10Z")
Thanks for the help, but I don't quite understand your message WAN has dynamic ip and I have created a subdomain with cname that points to a ddns service (duckdns) , the ddns service, runs on the nas [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com) \> [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org) \> 185.67.107.194 [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com) has record DNS CNAME to [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org) ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 8:23pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/9 "2021-01-11T20:23:17Z")
My domains are: My main domain is: [rodriguezcaroabogados.com](http://rodriguezcaroabogados.com/) But as I have detailed previously for this process I have created a subdomain (CNAME) that points towards a ddns service (duckdns) which would be the important ones for the case: My main subdomain is: **[intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com/)** My ddns service domain is: **[rcaintranet.duckdns.org](http://rcaintranet.duckdns.org/)** Create a new certificate NAS: Security / Certificates panel. I am asked to fill in the following details. Domain Name: [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com/) Email: [servidor@rodriguezcaroabogados.com](mailto:servidor@rodriguezcaroabogados.com) Subject Alternative Name: [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org/) It produced this output: The error I get when I click on Next is "Failed to connect to Let's Encrypt. Please make sure the domain name is valid" Domain Name: [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com/) Email: [servidor@rodriguezcaroabogados.com](mailto:servidor@rodriguezcaroabogados.com) Subject Alternative Name: The error I get when I click on Next is "Failed to connect to Let's Encrypt. Please make sure the domain name is valid" Im using: [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com/) ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 9:46pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/10 "2021-01-11T21:46:27Z")
The point is... why this: ```auto intranet.rodriguezcaroabogados.com. 14399 IN CNAME rcaintranet.duckdns.org. rcaintranet.duckdns.org. 59 IN A 185.67.107.194 rcaintranet.duckdns.org. 599 IN MX 50 rcaintranet.duckdns.org ``` instead of this: ```auto intranet.rodriguezcaroabogados.com. 59 IN A 185.67.107.194 intranet.rodriguezcaroabogados.com. 599 IN MX intranet.rodriguezcaroabogados.com ``` Do you really have an `intranet` email server (for `@intranet.rodriguezcaroabogados.com` addresses)? ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 9:52pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/11 "2021-01-11T21:52:20Z")
No, I don't have a mail server ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 9:53pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/12 "2021-01-11T21:53:22Z")
The burning question is then: why use duckdns instead of the dns for `rodriguezcaroabogados.com`? If you are using the duckdns API to dynamically modify DNS records I can understand that. Is that the case? ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 9:57pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/13 "2021-01-11T21:57:43Z")
For the dynamic ip of the ISP WAN has dynamic ip and I have created a subdomain with cname that points to a ddns service (duckdns) , the ddns service, runs on the nas I'm not using it for that, just for the issue of dynamic ip as I have mentioned before I am very sorry if I am not understanding what you are saying and it is beyond my knowledge. Maybe it's obvious and I don't realize where the trick of what you want to tell me is. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 10:02pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/14 "2021-01-11T22:02:44Z")
Fair enough. 🙂 Given that: `rcaintranet.duckdns.org. 59 IN A {current WAN IP}` Am I correct in stating that your NAS: 1. listens on port 80 at that IP. 2. can communicate outbound. ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 10:05pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/15 "2021-01-11T22:05:16Z")
1.Yes 2.Yes Have 80 and 443 open and forward on router to the nas ports Can check that [intranet.rodriguezcaroabogados.com](http://intranet.rodriguezcaroabogados.com) and [rcaintranet.duckdns.org](http://rcaintranet.duckdns.org) , appears the nas login page ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 10:08pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/16 "2021-01-11T22:08:39Z")
I'm seeing the following: ```auto http://rcaintranet.duckdns.org (implied port 80) 302 Moved temporarily https://rcaintranet.duckdns.org:5001/ 200 OK ``` ```auto https://rcaintranet.duckdns.org (implied port 443) 200 OK ``` Is that correct? ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 10:13pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/17 "2021-01-11T22:13:48Z")
The nas has an option activated to redirect http to https I have tried to do the certificate process in the two available ways (on/off), but it gives the same result, error. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 10:17pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/18 "2021-01-11T22:17:01Z")
Let's Encrypt always uses port 80 as the entry for connection. Redirection to port 443 is allowed. Redirection to port 5001 is **not**. > Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. It does not accept redirects to IP addresses. When redirected to an HTTPS URL, it does not validate certificates (since this challenge is intended to bootstrap valid certificates, it may encounter self-signed or expired certificates along the way). > > The HTTP-01 challenge can only be done on port 80. Allowing clients to specify arbitrary ports would make the challenge less secure, and so it is not allowed by the ACME standard. > **[Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/#http-01-challenge)** > > When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this validation is handled automatically by your ACME... ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 10:19pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/19 "2021-01-11T22:19:31Z")
I have disabled the option for redirection, can you check? is 200 ok on 80 now? ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 10:19pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/20 "2021-01-11T22:19:42Z")
Much better. 🙂 The question still remains: why redirect externally to port 5001 rather than to port 443? ---
**Author:** ![Maguila](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maguila/32/45667_2.png) [@Maguila](https://community.letsencrypt.org/u/Maguila)\ **Post date:** [January 11, 2021, 10:22pm UTC](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748/21 "2021-01-11T22:22:48Z")
Because the nas rules are designed in such a way that it does not let you use port 80 or 443, it has to say in some way reserved for the nas system [Next page](https://community.letsencrypt.org/t/error-connection-new-cert-synology/141748.md?page=2)