Synology NAS SSL acme.sh Let's Encrypt Reverse Proxy Home Server HTTPS

🔒 Ready to get rid of that “Not Secure” warning?

If you run a home server, you’ve probably seen that dreaded red warning — “Not Secure.” Every time you access your self-hosted services like a wiki, project management tool, or code server from outside your network, the browser won’t let you forget it. Beyond being annoying, HTTP traffic is sent in plain text, which means passwords and session cookies can be exposed. It’s a real security risk.

Today, we’ll walk through how to set up free Synology NAS SSL certificates using acme.sh and Let’s Encrypt, then configure a reverse proxy so all your home services get HTTPS. With automatic renewal every 90 days, it’s practically a set-and-forget setup!

🏗️ Architecture overview — the NAS is your gateway

Let’s start with the big picture. The core concept is simple — use your Synology NAS as the single HTTPS entry point for all your services.

Component	Role	Example
Public IP:443	External HTTPS entry point	Router → forwarded to NAS
Synology NAS	nginx reverse proxy + SSL termination	192.168.1.100
Backend Server A	Wiki, PM tools, etc.	192.168.1.10:8080, :9090
Backend Server B	Code server, etc.	192.168.1.20:5555

When someone visits wiki.example.com, the router forwards the request to the NAS, and nginx routes it to the correct backend server based on the Host header. You only need to manage SSL certificates in one place.

📋 Prerequisites

• A domain — available from Namecheap, Cloudflare, GoDaddy, etc. for ~$10/year
• Synology NAS — running DSM 7.x or later
• Router — with port forwarding support
• Home server(s) — at least one service you want to expose
• Static public IP or a DDNS service

🛠️ Step 1 — Domain & DNS configuration

After purchasing a domain, set up DNS records. All subdomains should point to the same public IP.

Hostname	Type	Value
example.com	A	YOUR_PUBLIC_IP
wiki.example.com	A	YOUR_PUBLIC_IP
pm.example.com	A	YOUR_PUBLIC_IP
code.example.com	A	YOUR_PUBLIC_IP

Yes, they all point to the same IP — the NAS reverse proxy distinguishes them by the Host header.

🔀 Step 2 — Router port forwarding

Configure your router to forward these ports to the NAS.

External Port	Internal Destination	Purpose
443	NAS_IP:443	HTTPS (reverse proxy)
80	NAS_IP:80	HTTP (Let’s Encrypt validation)
2222	NAS_IP:22	SSH access

📦 Step 3 — Install acme.sh

SSH into your NAS and install acme.sh.

# SSH into the NAS
ssh -p 2222 admin@your-nas-ip

# Install acme.sh
wget -O - https://get.acme.sh | sh

# Register Let's Encrypt account
~/.acme.sh/acme.sh \
  --register-account \
  -m your-email@example.com

Once installed, the executable and configuration files will be in the ~/.acme.sh/ directory.

📜 Step 4 — Issue SSL certificate (multi-domain)

A single certificate can cover multiple subdomains. Use multiple -d flags to issue a SAN (Subject Alternative Name) certificate.

sudo ~/.acme.sh/acme.sh \
  --issue \
  -d wiki.example.com \
  -d pm.example.com \
  -d code.example.com \
  -w /var/lib/letsencrypt \
  --keylength ec-256

🚀 Step 5 — Deploy certificate to Synology DSM

acme.sh includes a built-in deployment hook for Synology (synology_dsm). It automatically imports the issued certificate into DSM’s certificate manager.

sudo SYNO_Username=admin \
  SYNO_Password="your-password" \
  SYNO_Scheme=http \
  SYNO_Hostname=localhost \
  SYNO_Port=5000 \
  SYNO_Certificate="my-ssl-cert" \
  ~/.acme.sh/acme.sh \
  --deploy \
  -d wiki.example.com \
  -d pm.example.com \
  -d code.example.com \
  --deploy-hook synology_dsm

Once deployment succeeds, you can verify the new certificate in DSM → Control Panel → Security → Certificate.

🔄 Step 6 — Configure DSM reverse proxy

In DSM → Control Panel → Login Portal → Advanced → Reverse Proxy, create a rule for each service.

Rule Name	Source (HTTPS)	Destination (HTTP)
wiki	wiki.example.com:443	192.168.1.10:8080
pm	pm.example.com:443	192.168.1.10:9090
code	code.example.com:443	192.168.1.20:5555

After creating the rules, go to Control Panel → Security → Certificate → Settings and assign the SSL certificate to each reverse proxy rule.

🔃 Step 7 — Reload nginx

After changing the configuration, you need to reload nginx for the changes to take effect.

# Regenerate nginx config
sudo /usr/syno/bin/synow3tool \
  --gen-all

# Reload nginx (zero-downtime)
sudo nginx -s reload

# Verify config is valid
sudo nginx -t

If nginx -t returns syntax is ok, you’re all set. Open https://wiki.example.com in your browser and you should see the green padlock!

⏰ Step 8 — Automatic renewal

Let’s Encrypt certificates expire after 90 days, but acme.sh installs a cron job that auto-renews every 60 days. You can verify it’s set up:

# Check the cron job
crontab -l | grep acme

If you ever need to manually renew and redeploy, here’s how:

# Renew certificate
sudo ~/.acme.sh/acme.sh --renew \
  -d wiki.example.com \
  -d pm.example.com \
  -d code.example.com

# Redeploy to DSM
sudo SYNO_Username=admin \
  SYNO_Password="your-password" \
  SYNO_Scheme=http \
  SYNO_Hostname=localhost \
  SYNO_Port=5000 \
  SYNO_Certificate="my-ssl-cert" \
  ~/.acme.sh/acme.sh \
  --deploy \
  -d wiki.example.com \
  -d pm.example.com \
  -d code.example.com \
  --deploy-hook synology_dsm

# Reload nginx
sudo /usr/syno/bin/synow3tool \
  --gen-all && sudo nginx -s reload

In most cases though, the cron job handles everything automatically — you’ll rarely need to run this manually.

🔧 Troubleshooting — common issues

Problem	Cause	Solution
Port 80 blocked	ISP policy	Use DNS-01 challenge (Cloudflare API, etc.)
Certificate not applied after renewal	Missing nginx reload	synow3tool --gen-all + nginx -s reload
Browser shows old certificate	Cache	Clear browser cache or check certificate assignment in DSM
Let’s Encrypt rate limit	Max 5 duplicate certs/week	Use --staging server for testing
Adding a new subdomain	—	Add DNS A record → add -d flag and reissue → deploy → add RP rule

🛡️ Security best practices

• Never expose DSM directly to the internet — always use a reverse proxy or VPN
• Use SSH key authentication — much safer than password login
• Keep DSM updated — Synology regularly releases security patches
• Enable 2FA — essential for DSM admin accounts
• Firewall rules — only open ports 80 (ACME), 443 (HTTPS), and SSH
• Use ECC certificates (ec-256) — superior in both performance and security

📚 References

• acme.sh official GitHub — full installation and usage docs
• acme.sh Synology NAS guide — synology_dsm deploy hook details
• Let’s Encrypt official docs — certificate policy, rate limits, FAQ
• Synology DSM certificate management — DSM 7.x official help
• BookStack wiki self-hosting guide — setting up a wiki on the same infrastructure (related post)

✅ Wrapping up

To summarize, there are just three key steps to Synology NAS SSL setup — issue a certificate with acme.sh, deploy it with the synology_dsm hook, and route services through the reverse proxy. Once you understand these three pieces, you can scale to as many subdomains as you need using the exact same pattern.

Once everything is configured, acme.sh handles renewal and redeployment every 60 days automatically — it’s truly a set-and-forget system. There’s nothing quite like seeing that green padlock on your own home server for the first time!