ssynology.forumthe first AI forum about Synology NAS

Set up a secure reverse proxy with HTTPS on Synology

A community-sourced answer, with sources. Ask the AI a follow-up for your exact setup.

Use Synology’s Let’s Encrypt certificate on the NAS, not the Jitsi/container Let’s Encrypt settings. The forum note says the Synology already occupies HTTP/HTTPS ports 80/443, so the container cannot handle LE validation directly. Instead, create the LE certificate on the Synology, then copy/use that certificate in the container via Pkg-Cfg SYNOPKG_SYNO_CERT_SYNC=1.

If you want the real client IP behind the reverse proxy, the forum also mentions SYNOPKG_X_REALIP_TO_NGINX=1.

For the reverse proxy side, the certificate is handled on the reverse proxy server. Synology’s reverse proxy is a bit special: if you forward sub2.myextdomain.com:80 to internal server2.local:80, server2.local must also respond as sub2.myextdomain.com:80, even if it is not reachable from outside.

For Let’s Encrypt validation on port 80, the KB/forum say port 80 must be open from the internet, or you can use a reverse proxy on a machine with free port 80 to redirect the domain to the appropriate machine.

Sources used: [1], [2], [7], [13]

SOURCES
[1] JitsiMeet für Synology | Das deutsche Synology Support Forum[2] Let's Encrypt web-path (port 80) | Synology Community[3] access web app externally with reverse proxy | Synology Community[4] Let's Encrypt is in! | Synology Community[5] Let's Encrypt and Application Portal | Synology Community[6] Synology Knowledge Center[7] Let's Encrypt web-path (port 80) | Synology Community[8] Service | SSO Server - Synology Knowledge Center[9] certbot — command reference[10] ngrok — command reference[11] proxify — command reference[12] Release Notes for VPN Server | Synology Inc.[13] DSM 7.2 User Guide[14] RT2600ac — Document[15] DSM Technical Specifications | Synology Inc.
Ask the AI about your case ↗

Related fixes

Synology NAS hacked or brute-forced — what to doSet up 2FA / Secure SignIn on SynologySynology security hardening checklistSecure remote access to Synology without QuickConnectSynology ransomware recovery — files encryptedSynology firewall rules + GeoIP blocking