Synology NAS SSL Certificate Setup! Easily Configure HTTPS! (Tutorial)

hey everyone today we're going to look at enabling https on a synology nas using a free ssl certificate this will be fully managed through dsm and you'll be able to renew your certificates after they expire they expire roughly every two to three months but you can do everything straight through dsm and the process is actually pretty simple but it actually requires a little bit of an explanation so bear with me through this video and hopefully by the end of it everything will make sense so before we get started i just want to mention that there are written instructions in the description where you'll be able to follow along with everything that we're doing in this video one more quick thing before we get started i'll be using duck dns a duck dns ddns host name in this tutorial but synology will give you a free synology.me hostname or you can use your own domain it doesn't matter you just have to ensure that you're using some sort of a domain name if you don't currently have one you could look into setting up a synology.me domain name or you can check out the tutorial i created on using duckdns which is a free alternative so to get started the first thing that you need to do is you need to port forward port 80 or 443 now it doesn't matter which port you pick but it has to be one or the other because this is the way that let's encrypt will validate your certificate i'm not going to go over this section because port forwarding is different depending on the router but i have a few different examples in the written instructions on how you can do this based on the router that you have so after you complete the port forwarding what you're going to have to do is you're going to have to go into synology's firewall and you need to ensure that you allow that port with whether it's 80 or 443 but you have to allow that port on your synology firewall so that it can properly validate the certificate once that's done we're going to be able to head over to the certificates section and we're going to be able to either replace our existing certificate or add a new one so when i say replace our existing certificate if you're using the free synology.me hostname that synology will provide for you it'll create a self-signed certificate so at that point what you'll be doing is actually replacing that certificate if you're using something else either your own domain name or a different ddns hostname from a different provider you can add a new certificate now that doesn't mean that you can't add a new certificate if you're using a synology.me hostname it just means that you have the option to replace the existing one so either add or replace the existing certificate and then you're going to move on to the next step which is get a certificate from let's encrypt and this is where we're actually going to be getting our certificate that will be applying to our host name once you do that assuming that you properly open port 80 or 443 you should be able to quickly get that new certificate and it'll bring you back to the main page the last step now is to actually configure all of our existing services to use that new certificate so that was actually the entire certificate setup process but this is where i have to explain a little bit on exactly what we did and how it works moving forward so whether you're using a ddns host name or a domain name that you purchased when you navigate to that domain it's going to be navigating to your external ip address so that's why right now if you try and actually access that host name and your synology's port it will never load it's never going to resolve that name and the reason for that is because your port whether it's the default are 5000 5001. if you're using the default ports what your system is actually trying to do is it's trying to access your external ip address and that port and since you haven't opened that port on your router you'll never be able to access it so we don't want to open that port if you want to access your nas externally you really want to set up a vpn server i'll leave a link in the description i just created a video on how you could set up a vpn server but the main point is that you don't want to have to open port 5001 in order to get this to work properly so now that we know when you navigate to that domain name it's accessing your external ip address what we really want to do is we want to set it up so that when you're accessing that domain name internally meaning when you're on your network we want it to navigate to the internal ip address of your nas so there's two main ways that you can do this the first is kind of my recommendation and the second is an alternative that you can use so my recommended approach is to set up a dns server on your nas now i just created a video on how you could set up pi hole on your nest and i'll leave a link for that in the description but you can just as easily use synology's dns server application in the package center i just don't have a tutorial for that up yet i personally like pihole because it provides network-wide ad blocking so if that's something that interests you you could check out that link so what we're going to do is we're going to actually open our dns server and we're going to create a local dns record and what this is going to be is it's going to be our local ip address for our nas and it's going to be mapped to that domain name that we just used to create that certificate and the reason this is the recommended approach is because you can set up pihole or any dns server for that matter to automatically be your router's dns server so every single device that is connected to your router will now use this dns server which will then forward your traffic onto an upstream provider like google or cloudfare or pretty much any dns provider you want so the key there is every device as long as you set up pi hole or a dns server properly every device that connects to it will automatically be able to resolve that domain name as soon as we create that dns record so the second option that we're going to look at is creating a local host record so that your client device can resolve that domain name by its local ip address so this will be different depending on the device that you're using i'm going to show this on a windows pc but i have links in the written instructions that will show you how to do it on linux or mac os so the important thing to note here is that the end result will actually be the same whether you have a dns server or you set up this host record but if you set up this host record it will only work on this one device you will have to configure it for every device that you have that's why a dns server is recommended because you're kind of blanket applying this to all of your devices so now that we applied either one of those options you'll see that we can navigate to that domain name and our dsm port and you'll actually be able to access it and everything will come up properly you'll have a full ssl certificate assigned to that domain name you can also run an nslookup at this time and you'll be able to see that when you navigate to that domain you're navigating to that internal ip address of your nas so now that you've configured this you have to note that if you're navigating to your nas through an smb share you have to use that new domain name that you just created and the reason for that is because you assigned it in your dns record so you'll no longer be able to use your nasa's server name now one way to resolve this is if your nas has multiple network interfaces and you have assigned different ip addresses to those network interfaces you can assign one ip address to be this domain name that we just created and you can create a second dns record which will be to the second ip address that you have assigned to your nas which will be the server name so you'll be able to access it by both the server name and the domain name but if you have a nas that only has one network interface then you'll only be able to navigate to it through that domain name we just created so we're gonna quickly look at two things that i'm hoping you'll find helpful now that we created everything and everything set up properly you can go back to your nasa settings and you can automatically redirect all of your http traffic to https as soon as you check this off if anyone tries to connect to that port 5000 it'll automatically route it back to 5001 and it will automatically be secured so that's the first thing the second thing is now that you created a certificate that certificate will expire and dsm does a pretty good job of automatically renewing these certificates but you need to keep port 80 or 443 opened if you don't have either one of those ports opened let's encrypt won't be able to connect to your nas and renew those certificates so if you don't have a reason to keep either of those ports opened what you can do is you can leave it open on your router and you can actually uncheck that rule that we created earlier and it will no longer be used so when you have to then go in and renew it what you do is you go back into your firewall check it off renew the certificate then you can go back in and close it so you're closing it at the nasa's level at this point you're kind of blocking connections on port 80 but it's a little easier to manage this in your nas just by a check box rather than having to port forward in your router settings every few months so this was a pretty long video for what is actually a very simple process but i wanted to make sure that you guys fully understood what we were doing and why we were doing it this allows you to actually have an ssl certificate without having to open any ports on your router it's kind of the best of both worlds if you guys have any questions please leave them in the comments once again i'm going to leave that link for pie hole in the description if you guys have any interest in setting that up if you like the video give it a thumbs up and please subscribe thanks guys

Channel: WunderTech

Views: 45,556

Keywords: synology nas https setup, synology nas https setup instructions, synology nas ssl certificate, synology nas ssl certificate setup, synology nas ssl certificate install, synology ssl certificate install, synology ssl certificate, synology nas https not secure, synology nas https certificate, synology nas https, synology nas ssl setup, synology nas ssl configuration, synology nas https configuration, synology https certificate not trusted, synology ssl, synology nas certificate

Id: VoF-qqKwIWw

Length: 9min 53sec (593 seconds)

Published: Wed Aug 12 2020