6

I am looking for a way to import a root certificate in a Synology server (the certificate comes from a ssl intercepting proxy).

I have copied the certificate to

/usr/share/ca-certificates/<somesubfolder>

And changed the permissions to 744 and owner to root:root. Then I made a symlink to the cert in

/etc/ssl/certs

This didn't change a thing, so I additionally modified the file

/etc/ca-certificates.conf

And added the line:

<somesubfolder>/<certfile.crt>

Again, this didn't change the behaviour, still no connection possible to the outside world. Any ideas?

Improve this question
6
  • So, you're trying to make it so this Synology box can initiate outgoing connections through a proxy?
    – Spiff
    Commented Jul 20, 2016 at 17:21
  • @Spiff yes this is the goal. For notifications and update checks and stuff like this.
    – Christian
    Commented Jul 20, 2016 at 19:58
  • Does your Synology box have an "update-ca-certficates" command? Or maybe an "update-ca-trust" command?
    – Spiff
    Commented Jul 20, 2016 at 20:31
  • @Spiff Sorry I forgot to mention that I already tried that - no this command isn't available.
    – Christian
    Commented Jul 20, 2016 at 20:59
  • 1
    Does your Synology box have a ` /etc/ssl/certs/ca-certificates.crt` (single fail containing all the trusted root CA certs)? If so, have you edited it to include your new root CA cert that you want to trust? If you don't have an update-ca-certificates command to do this, you might have to do it by hand.
    – Spiff
    Commented Jul 20, 2016 at 21:15

5 Answers 5

Reset to default
3

Okay, thanks to Spiff I could solve the problem. Here is what I did:

  1. Copy the cert (with ending .crt) to /usr/share/ca-certificates/randomsubfolder/

  2. Import the cert in the list of all root-ca-certs:

    sudo sh -c 'cat /usr/share/ca-certificates/randomsubfolder/cert >> /etc/ssl/certs/ca-certificates.crt'

Note: This is not officially supported by synology. A future DSM Update could restore the list of root-ca-certs to default and then you'd have to import the cert again.

Improve this answer
2

For Synology DSM 7 this is the proper way to install your private CA certificates:

  • Copy the ca certs ending in .crt in the directory: /var/db/ca-certificates and change (chmod) permissions of the certs to 644.
  • Then execute the script provided by synology: update-ca-certificates.sh
  • Reboot
  • Enjoy!
Improve this answer
1
  • this seems to have worked for me, but i'm curious if there's any official documentation on this being the "proper way". also, i'm curious if anyone has seen Synology updates overwrite certs added this way?
    – bheinz
    Commented Aug 14, 2023 at 20:14
1

I'm on DiskStation 7.2 and none of these solutions worked for me. What ultimately did work was this: I had my firewall CA certificate in PEM format, I copied the contents of the file to the /etc/ssl/certs/ca-certificates.crt file. After a reboot it worked.

Make a backup copy first

cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt.backup

Edit the contents of the ca-certificates.crt file and append the contents of your CA certificate.

sudo vi /etc/ssl/certs/ca-certificates.crt
Improve this answer
0

In Debian / Ubuntu we use update-ca-certficates to add certificates. The thing is that update-ca-certficates is a shell script and nothing prevents it to work on Synology too. To achieve that you need to do the following:

  1. SSH into Synology
  2. Get update-ca-certficates from debian sources
sudo wget -O /usr/sbin/update-ca-certificates https://sources.debian.org/data/main/c/ca-certificates/20211016/sbin/update-ca-certificates
sudo chmod +x /usr/sbin/update-ca-certificates
  1. Create directory for additional certificates and copy your certificate in it
sudo mkdir -p /usr/local/share/ca-certificates
sudo chmod 755 /usr/local/share/ca-certificates
sudo cp /path/to/your/certificate.crt /usr/local/share/ca-certificates
sudo chmod 644 /usr/local/share/ca-certificates/*.crt
  1. Call update-ca-certificates
sudo update-ca-certificates

After running the script you should see:

1 added, 0 removed; done.

The benefit of this approach is that you can call update-ca-certificates from Synology's Task Scheduler on boot, this should allow the certificates to survive DSM updates.

Improve this answer
0

On DSM 7.2 the script /usr/syno/bin/update-ca-certificates.sh exists to re-create content of /etc/ssl/certs.

It allows to add your own certificates as .crt to /usr/syno/etc/security-profile/ca-bundle-profile/ca-certificates/. These certificates will be recognized when running the script.

That directory doesn't exist by default, so create it if missing. Haven't found an official way to get it created yet (2024-02).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .