For the most part, the Synology NAS does a good job of keeping its own certificates up to date. But at least one certificate requires special handling.
This certificate is managed by Synology using Let's Encrypt. The certificate is automatically rotated before its 90-day expiration is reached. The certificate is a wildcard certificate matching all hostnames: *.mrachelski.synology.me
This is a separate Let's Encrypt certificate that is fronting the few publicly accessible services hosted on this machine. These services have been dwindling to almost none as true internet services are placed on host-1.rachelski.net (internet hosted server) or are hosted in the K8S cluster. This certificate frequently has problems when I remove a service from the NAS.
As of 2026-02-27, it has been removed from the NAS since the only remaining service was a blog that no one was using.
This is the certificate requiring the most work to maintain. Vault issues certificates for a maximum of 30 days, so it is rotated automatically by a cron job on the NAS that uses acme.sh to refresh the certificate on the Synology NAS.
NOTE: I have recently found that an API token named diskstation exists on the Technitium server. I cannot find any notes about why it exists. It is possible I set it up for this activity, as the acme.sh install on the NAS needs a Technitium API token for the DNS challenge, but I cannot be sure.
UPDATE: This MAY be related to the setup of the kubernetes cluster 'external-dns' as I have found a set of secrets in vault under the path: apps/external-dns-rfc2136
Before automated rotation was working, I needed to manually re-issue a certificate each month. If automated rotation ever fails, the same manual process can be used as a fallback. It involves running a Vault command, using Mark's Vault credentials, to issue a 30-day certificate.
The instructions for doing this can be found in the Manual Certificates section of the rachelski.internal PKI page.
The command will output the certificate strings in PEM format that I need to manually load into the Synology system using the console. The PEM files needed are for the Private Key, Certificate, and Intermediate Certificate. I will use the Add button to Replace an existing certificate.
This is completely managed by Synology for its QuickConnect system. Synology does not document QuickConnect very well, but it can be used to achieve remote access.