Use Synology’s Let’s Encrypt certificate on the NAS, not the Jitsi/container Let’s Encrypt settings. The forum note says the Synology already occupies HTTP/HTTPS ports 80/443, so the container cannot handle LE validation directly. Instead, create the LE certificate on the Synology, then copy/use that certificate in the container via Pkg-Cfg SYNOPKG_SYNO_CERT_SYNC=1.
If you want the real client IP behind the reverse proxy, the forum also mentions SYNOPKG_X_REALIP_TO_NGINX=1.
For the reverse proxy side, the certificate is handled on the reverse proxy server. Synology’s reverse proxy is a bit special: if you forward sub2.myextdomain.com:80 to internal server2.local:80, server2.local must also respond as sub2.myextdomain.com:80, even if it is not reachable from outside.
For Let’s Encrypt validation on port 80, the KB/forum say port 80 must be open from the internet, or you can use a reverse proxy on a machine with free port 80 to redirect the domain to the appropriate machine.
Sources used: [1], [2], [7], [13]