You are unable to create or renew the Let's Encrypt certificate on a Synology device.

The registration or renewal of Let's Encrypt certificate may not proceed under the following reasons:

• The Let's Encrypt certificate is transferred from another device.¹
• You configured a primary domain name and multiple subject alternative names for a certificate (e.g., example.com and mail.example.com), but not all the domain names point to the public IP address of your Synology device.²
• You used Synology DDNS to register or renew a Let's Encrypt certificate when the Synology DDNS status is not activated.
• You used Synology DDNS to register or renew a Let's Encrypt certificate when the Synology DDNS hostname has been changed.

• DSM 6.2.4 Update 2 and above¹
• SRM 1.2.3 and above

Point domain names to the correct IP address

To securely encrypt network communication via Let's Encrypt, the A record (IPv4) of your Synology device should point the FQDN (fully qualified domain name) to the IP address correctly on the DNS server. For an IPv6 network environment, the aforementioned configuration should be applied to the AAAA record.

1. Run the command "nslookup" along with the FQDN of your Synology device as shown below (detailed steps). You will get the IP address to which the FQDN in the A record is pointing.¹
   
2. Sign in to your Synology device via SSH (detailed steps).
3. Enter curl checkip.synology.com or curl checkipv6.synology.com to get the public IPv4 or IPv6 address of your Synology device.
   
4. Ensure that the IP address registered from step 1 matches the one registered from step 3. If not, please contact your DNS hosts or domain providers to correct the A or AAAA record settings of your device.

If you have applied subnet names to any of your DSM services (e.g., Synology Chat), you also have to check the A or AAAA record settings of these subnets by following the steps above.

Forward port 80 to your Synology device

Network packets should be redirected from port 80 of your parent router/switch to port 80 of your Synology device.² Before checking port forwarding configurations, please verify if port 80 on your Synology device is open (detailed steps).

Once you have verified the accessibility of your Synology device's port 80, you can check the port forwarding from your router to your Synology device by conducting the following tests:

• Test 1: Open a web browser on your local network (i.e., the one where your Synology device is located), and go to the web page "http://Private IP address of your Synology device".
• Test 2: Open a web browser on your local network, and go to the web page "http://FQDN of your Synology device".
• Test 3: Open a web browser outside your local area network, and go to the web page "http://FQDN of your Synology device".

If you see the same web page from the results of the above tests, you have successfully directed port 80 of your router to port 80 of your Synology device.

• Frequently asked questions about insecure connections and certificates
• How do I obtain a certificate from Let's Encrypt on my Synology NAS?