# First certificate for Synology NAS **URL:** \ **Category:** Help\ **Created:** [May 15, 2021, 3:14pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768 "2021-05-15T15:14:54Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Immanuel](https://avatars.discourse-cdn.com/v4/letter/i/cab0a1/32.png) [@Immanuel](https://community.letsencrypt.org/u/Immanuel)\ **Post date:** [May 15, 2021, 3:14pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768/1 "2021-05-15T15:14:54Z")
Hello guys, This is the first time I am trying to get a Let's Encrypt certificate. I am already struggling for quite some time. When I check [immanuelcloud.nl - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?q=immanuelcloud.nl) it reports something wrong for acme, but I can't figure out what. I have opened port 80 on my router to port 80 on the Synology, but that does not seem to work. Anybody can shine a light on it? Hugely appreciated! My domain is: immanuelcloud.nl I ran this command: Request for certificate with Synology DSM 6.2.4 It produced this output: Fetchinh [http://immanuelcloud.nl/.well\_known/acme-challange/](http://immanuelcloud.nl/.well_known/acme-challange/)....: Timeout during connect (likely firewall problem) My web server is (include version):Synology DSM 6.2.4 The operating system my web server runs on is (include version):Synology DSM 6.2.4 My hosting provider, if applicable, is: ISP is KPN (netherlands), Domain via strato using DynDNS I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No, just Synogy DSM The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [May 15, 2021, 3:38pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768/2 "2021-05-15T15:38:52Z")
Hi @Immanuel > [@Immanuel](#): > > When I check [immanuelcloud.nl - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?q=immanuelcloud.nl) it reports something wrong for acme, but I can't figure out what. you can, you have already the answer: > [@Immanuel](#): > > I have opened port 80 on my router to port 80 on the Synology, but that does not seem to work. Exact that's the problem. Your port 80 doesn't answer, so you can't create a certificate via http validation. Why? I don't know. Wrong router config, your ISP blocks, a firewall kills the connection silent ... ---
**Author:** ![Immanuel](https://avatars.discourse-cdn.com/v4/letter/i/cab0a1/32.png) [@Immanuel](https://community.letsencrypt.org/u/Immanuel)\ **Post date:** [May 15, 2021, 3:45pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768/3 "2021-05-15T15:45:47Z")
Hi @JurgenAuer, That is weird. If I try to go to immanuelcloud.nl:80 I do get to my Synology login screen (forwarded via port 5001) ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [May 15, 2021, 4:04pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768/4 "2021-05-15T16:04:48Z")
Welcome to the Let's Encrypt Community 🙂 This might help: > [@Clarification of Synology NAS DiskStation Manager (DSM) Documentation of Let's Encrypt Integration](https://community.letsencrypt.org/t/clarification-of-synology-nas-diskstation-manager-dsm-documentation-of-lets-encrypt-integration/142511): > > [h…](https://www.synology.com/en-us/knowledgebase/DSM/tutorial/Network/How_to_enable_HTTPS_and_create_a_certificate_signing_request_on_your_Synology_NAS#t4.1) * * * For `http://immanuelcloud.nl`, which Let's Encrypt uses for an http-01 challenge, port 80 is unresponsive/closed. I eventually received a 504 Gateway Timeout response. You can check this with: > **[Open Port Check Tool - Test Port Forwarding on Your Router](https://www.yougetsignal.com/tools/open-ports/)** > > Port checker is a utility used to identify your external IP address and detect open ports on your connection. This tool is useful for finding out if your port forwarding is setup correctly or if your server applications are being blocked by a... For `https://immanuelcloud.nl`, which Let's Encrypt would use for an http-01 challenge if there were a proper http to https redirect in place, port 443 has a 302 Moved Temporarily forward to port 5001, which Let's Encrypt will not use for an http-01 challenge. You can check this with: > **[Redirect Checker | Check your Statuscode 301 vs 302](https://www.redirect-checker.org/)** > > Check your URL redirect for accuracy. Our Redirect Checker will analyse all redirections. Try Now! * * * > Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and **only to ports 80 or 443**. It does not accept redirects to IP addresses. When redirected to an HTTPS URL, it does not validate certificates (since this challenge is intended to bootstrap valid certificates, it may encounter self-signed or expired certificates along the way). > > The HTTP-01 challenge can only be done on port 80. Allowing clients to specify arbitrary ports would make the challenge less secure, and so it is not allowed by the ACME standard. > **[Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/#http-01-challenge)** > > When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this validation is handled automatically by your ACME... ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [June 14, 2021, 4:05pm UTC](https://community.letsencrypt.org/t/first-certificate-for-synology-nas/151768/5 "2021-06-14T16:05:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.