For what itās worth I manage to install 3 certificates on my Synology NAS (running DSM 5.2, other version might work slightly different) for 3 subdomains I registered. I used the manual LE setup on an Ubuntu box. The services setup are the Synology Surveillance Station, Photostation and a personal website. All 3 work a little different as:
- Personal website is hosted from the web directory
- Surveillance station works from a seperate https port being setup with an alias in the config portal screen
- Photostation is setup by Synology as a sort of virtual host
To begin I registered a domainname for which I proceeded to create 3 cname records:
These redirected to 3 DDNS sites which all point to my public and dynamic ip address which is updated from my router (could have been my NAS as well I suppose).
In my web directory on the Synology where all port 80 traffic lands I created the following index.php (so yes you would need to have php enabled in DSM). Note that Photostation works ok by just directing to āphotoā. No that to force http in Photostation that needs to be enabled in the settings of the Photostation itself.
<?
$domain = $_SERVER["SERVER_NAME"];
if ($domain == "site1.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: site1");
}
else if ($domain == "site2.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: photo");
}
else if ($domain == "site3.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: https://site1.mydomain.com:<https port>/<alias>");
}
?>
Also I created the following directory in the web directory:
- site1 - containing my personal website
I updated this config /etc/httpd/conf/httpd.conf-user file to be like this near the bottom:
<VirtualHost *:80>
Include sites-enabled-user/*.conf
Redirect permanent /site1 https://site1.mydomain.nl:443/site1
</VirtualHost>
To setup the challenge response strings I had to trick a bit as the redirects will not mount up to what the Letās Encrypt response URL is. In other words Photostationās url will be http://test2.mydomain.com/photo/ā¦ where LE expects http://test2.mydomain.com/.well-known/acme/.
So to create the 3 challenge / response files I changed the index.php to temporarily be like the below so all 3 subdomains will look in /var/services/web/.well-known/acme/
<?
$domain = $_SERVER["SERVER_NAME"];
if ($domain == "site1.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: .");
}
else if ($domain == "site2.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: .");
}
else if ($domain == "site3.mydomain.com") {
Header( "HTTP/1.1 301 Moved Permanently" );
header("location: .");
}
?>
Also I disabled the redirect in /etc/httpd/conf/httpd.conf-user as I don want that during the setup process. Donāt forget to restart the webserver when you do:
/usr/syno/sbin/synoservicecfg --restart httpd-user.
From here I ran the LE setup, just entered the 3 subdomains I setup with my hosting provider and registered with LE. For each site I created the response file as described before in this thread instructed by the LE manual setup process.
That generates the pem files to import in Synology DSM.
After that I reverted the /etc/httpd/conf/httpd.conf-user and the index.php and all seems to work reasonably well now. Only exception are the mobile syno clients for the Surveillance Station that still require the https port (test3.mydomain.com:)
