Get a Certificate for a not public NAS

Help
1

A general question.
I have a domain and I use it only for a simple static page.
Also I have a synology nas, that has no dyndns or other acces from external configured. (dont need that)

My goal is to get a wildcard certificate for *.nas.example.com
I need certificates for several docker apps I use on my nas. So I could address them by service.nas.example.com

I followed Certbot Instructions | Certbot

with sshfs I mounted the webroot of nas.example.com and on my nas I tried to run the acme script.

But I only get

Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.

2

Hi @Mannshoch, and welcome to the LE community forum :slight_smile:

Please show what that script looks like.

Also, you mentioned:

But wildcard certs require DNS-01 authentication [not HTTP-01/webroot].

4 Likes
3

Hm.. okay. It seems not so easy to get ssl certificate for my nas.

If I instead chose a certain subdomain test.nas.example.com
I get the error message that a DNS record is missing.

My hoster use Plesk but I have only a very limited access to the ssh. It seems only meant to upload/download data.

If I go for the DNS aproach. Is there a need that acme need direct access? Or could I somehow manually add the data to the DNS?

4

You can authenticate via DNS-01 manually.
It is not recommended as it can't be easily automated and would require you to repeat those steps prior to the 90 day cert expiration.

That said, if you intend on accessing that site from the Internet, you will need the name to resolve to your IP. And if you don't intend on accessing it from the Internet, then you don't really need a globally signed cert [you could use a private cert and make it last as long as you like].

5 Likes
5

Seems more difficult than I hoped.
These TXT records change on every cert update?

6

Yes, they do.

4 Likes
7

Automation exists.
I would look carefully into going down that path.
[it's well worth it in the end]

4 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.