Synology's DiskStation Manager (DSM) handles certificates centrally through Control Panel → Security → Certificate, regardless of which specific service (DSM's own web interface, a reverse-proxied service, individual packages) will end up using them.
Option A: Let a built-in Let's Encrypt wizard handle it
- In the Certificate tab, click Add, then choose "Get a certificate from Let's Encrypt."
- Provide the domain name and an email address. This requires that your chosen hostname actually resolves to your NAS and that port 80 is reachable from the internet for the duration of validation — typically via port forwarding on your router, or Synology's own QuickConnect/DDNS service if you're using that instead of a domain you manage yourself.
- DSM handles issuance and, going forward, automatic renewal — you shouldn't need to repeat this process manually as long as the same domain continues to resolve to the NAS and port 80 stays reachable at renewal time.
Option B: Import an existing certificate
If you already have a certificate issued elsewhere (through your own CA, a wildcard cert managed centrally for multiple services, or a provider DSM's wizard doesn't support), choose "Import certificate" instead and supply the private key, certificate, and intermediate certificate files. Unlike the Let's Encrypt path, DSM does not renew an imported certificate automatically — that's on you to track and repeat before expiry.
Assigning certificates to specific services
DSM lets a single NAS hold multiple certificates and assign different ones to different services — the certificate serving DSM's own management interface doesn't have to be the same one serving a reverse-proxied application or an individual package's web interface. After adding a certificate, use the "Configure" button in the same Certificate screen to see and adjust which service uses which certificate; this is also where you set your default certificate for services that don't have an explicit assignment.
Reverse Proxy for multiple HTTPS services on one NAS
If you're running several web-facing services on the same NAS (a media server, a personal cloud app, a self-hosted tool) and want each on its own subdomain with its own valid certificate, DSM's built-in Reverse Proxy feature (Control Panel → Login Portal → Advanced, on recent DSM versions) lets you route different hostnames to different internal ports, each able to use its own certificate — avoiding the need to expose multiple raw ports directly.
What to check if the DSM interface itself won't accept a new certificate
A mismatch between the certificate's domain/SAN list and the hostname you're actually browsing to is the most common cause of a browser still warning after you've assigned a new certificate — confirm you're reaching DSM via the exact hostname the certificate covers, not the NAS's raw IP address or QuickConnect ID, since a certificate for one won't validate against the other.
Loading comments…