For the records, Synology has a KB article on this issue: How do I obtain a certificate from Let's Encrypt on my Synology NAS? - Synology Knowledge Center
An upgrade to 6.2.4 update 2 or later is supposed to address it.
For users who can't upgrade, it looks like ssh'ing to the NAS, then running
sudo -i && cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt.ORIG && curl -k "https://letsencrypt.org/certs/isrgrootx1.pem" >> /etc/ssl/certs/ca-certificates.crt && reboot
does work (adding Root X1 to the certs).