That's indeed probably a more sustainable method, that's why I asked which options FileZilla offers earlier, but didn't get any answer 
Problem might (I don't have a clue) be that the Synology webroot isn't accessible from the Windows Server.
Another option might be to reverse proxy requests for /.well-known/acme-challenge/ on the nginx webserver on the Synology to the Windows Server internally. But that would probably interfere with getting certificates on the Synology.