letsencrypt with own domain (but no qnap cloud)

English General
1

I have my own domain and I wanted a certificate from Letsencrypt without myqnapcloud in the way.

At first I tried putting a reverse proxy in front of the nas with but that turned out to cause issues with qulog so I removed it.

Next, I tried installing acme.sh directly and this seems to work, here are the steps:

# get the API key for your DNS provider: avoids opening up the webserver to host the verification token
# login via ssh as admin, drop down to the shell
cd /tmp
curl -L \
  https://github.com/acmesh-official/acme.sh/archive/master.tar.gz \
  -o acme.sh.tar.gz
tar -xvf acme.sh.tar.gz
cd acme.sh-master/
# homedirs survive reboots / upgrades but any share would do
mkdir /share/CACHEDEV1_DATA/homes/admin/acme.sh
./acme.sh --install \
  --home /share/CACHEDEV1_DATA/homes/admin/acme.sh \
  -m "youremail@example.org"
# the acme install script will modify the RAM copy of the crontab, need to persist the changes
crontab -l | grep acme.sh >> /etc/config/crontab
# adapt to your specific DNS server, here I am using the (default) zone of OVH
export OVH_END_POINT="ovh-eu"
cd /share/CACHEDEV1_DATA/homes/admin/acme.sh/
./acme.sh --issue \
        --dns dns_ovh -d "yournas.yourdomain.com" \
        --reloadcmd "cat
/share/CACHEDEV1_DATA/homes/admin/acme.sh/yournas.yourdomain.com_ecc/yournas.yourdomain.com.key
/share/CACHEDEV1_DATA/homes/admin/acme.sh/yournas.yourdomain.com_ecc/fullchain.cer
> /etc/config/stunnel/stunnel.pem && /etc/init.d/stunnel.sh restart"

Warnings and notes:

  • if you prefer myqnapcloud to messing with the system like I did, by all means do: this works for me but if it breaks you keep the pieces :wink:
  • I did NOT use HTTP validation, but DNS: consult the API of the provider of your own domain to see how to obtain the API key to use with the DNSAPI
  • my NAS is NOT exposed on the internet and I have configured my local unbound installation to fake an entry for yournas.yourdomain.com so that both acme.sh and my local clients are happy
  • tested: survives reboots, daily suspend / standby cycles AND upgrades
3

I’m confused. If your NAS is not exposed to the internet what is the purpose of the certificate? Unless you are using your NAS in a “corporate” environment where there are many possible users and you want a level of security, there is no need to have a local certificate.

What is your reason for using one?

4

Getting rid of the habit of accepting self-signed certificates, for one.

Learning something new, as already mentioned in the other thread, also counts… plus maybe someone else needs it in a context where it is not just a nice-to-have and can benefit from this short guide.

5

Thanks for your sharing!!!

6

it would be nice if the functionality of lets encrypt was a little app in qnap app store. that way it would automate the process. I also dont use the myqnapcloud so having just an app for Letsencrypt without the myqnapcloud would be useful.