Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: vaskion.com
I ran this command:
Go to Control Panel -> Security -> Certificate -> Renew
It produced this output:
Please check if your IP address, reverese proxy rules and firewall settings are correctly configured and try again.
My web server is (include version):
Synology Web Station 3.0.0-0287
The operating system my web server runs on is (include version):
Synology DSM 7.0 beta
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
WordPress 5.5.3-1025
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
Hello,
The renew of Let's Encrypt certificate stopped working after I updated to DSM 7.0. I have not changed the router fonfiguration so port 80 and 443 are still open just like before. I tried also to replace or add a new certificate. I also stopped the firewall during my tries. Every time though I got the same message:
Please check if your IP address, reverese proxy rules and firewall settings are correctly configured and try again.
Does anyone have the same problem? Any ideas how can I fix it?
I can't find something about Synology Web Station 3.0.0.
And a Beta - may be it's buggy.
First step: Ask in a Synology forum if there is a better log.
Looks like a global, too unspecific error message.
Some basics (ip address, open port 80) are ok. But you have a redirect http -> https, I don't know if the integrated Synology Letsencrypt client can work with that.
But: There - https://vaskion.com/.well-known/acme-challenge/1234 is a Synology answer, that looks ok.
I also submitted a ticket through DSM. It is in a state "Waiting for reply" for more than a week already...
I guess the whole DSM and its packages, as they are in beta, could be buggy and may be causing the issue. I still cannot tell. But there should be way to workaround it I hope...
Redirection from HTTP to HTTPS was working fine till now and I had no issues with renewing the certificates before. Unfortunately I cannot find this particular setting any more. Either they remove it or hide for some reason in DSM 7.0.
@JuergenAuer But: There - https://vaskion.com/.well-known/acme-challenge/1234 is a Synology answer, that looks ok.
PS: That result says: Your WordPress handles port 80, not Synology. So the validation via port 80 can't work, because the Synology-created validation file isn't visible.
I found iTheme Security plugin has such redirect and disabled the module, didn't work. Disabled the whole plug in, didn' work. Stopped the WordPress package from DSM, also didn't work...
How do you get the above result? How can I check whether my changes are in the right direction because currently I just blindly change something hoping it will finaly work?
It does look like you've now successfully disabled a lot of things on this DSM device. When I try to download this test file, I get a reply that looks to me like it's directly from the DSM software. So if the DSM is still unable to get a certificate under these conditions, I think it's probably a Synology bug.
You could try again and post the resulting log again, in case it's a different error message from the one that you got the first time. If it's still the same error, I think you'll probably have to wait for help from the Synology company or community.
Thanks a gain for all the help here!
Synology answered the ticket after a week or so and fixed it. There was a bug though as they told me this will be escalated to the development team.
