{"componentChunkName":"component---node-modules-gatsby-theme-blog-core-src-templates-post-query-js","path":"/get-https-on-diskstation-with-lets-encrypt/","result":{"data":{"site":{"siteMetadata":{"title":"one melo a day","social":[{"name":"twitter","url":"https://twitter.com/melo0187"},{"name":"github","url":"https://github.com/melo0187"}]}},"blogPost":{"__typename":"MdxBlogPost","id":"fc826d5e-b7dd-534f-ba51-b58e5b7fdecb","excerpt":"From the moment I got my DiskStation and made it available online, I wanted to try HTTPS. Organizations that issue certificates to use for…","body":"function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"layout\": \"post\",\n  \"title\": \"Get HTTPS on DiskStation with Let's Encrypt\",\n  \"author\": \"melo\",\n  \"date\": \"2016-01-28T21:29:16.000Z\",\n  \"categories\": [\"DiskStation\", \"https\", \"Let's Encrypt\", \"Technical\"],\n  \"slug\": \"get-https-on-diskstation-with-lets-encrypt\",\n  \"draft\": false,\n  \"meta_title\": \"Get HTTPS on DiskStation with Let's Encrypt\"\n};\n\nvar makeShortcode = function makeShortcode(name) {\n  return function MDXDefaultShortcode(props) {\n    console.warn(\"Component \" + name + \" was not imported, exported, or provided by MDXProvider as global scope\");\n    return mdx(\"div\", props);\n  };\n};\n\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, [\"components\"]);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"From the moment I got my DiskStation and made it available online, I wanted to try\\xA0HTTPS. Organizations that issue\\xA0certificates to use for HTTPS free of charge have been around for a while now (like StartSSL).\\xA0However you need to own a domain and I use DDNS, but thanks to Let\\u2019s Encrypt I can finally get a certificate to secure the communication to melo.myds.me with HTTPS!\"), mdx(\"h2\", {\n    \"id\": \"why-care-about-https\"\n  }, \"Why care about HTTPS?\"), mdx(\"p\", null, \"You might have noticed that more and more service providers like Google and Facebook made the move to serve their content through HTTPS by default and that the adoption of HTTPS has been pushed by organizations like the EFF. Instead of deciding whether a communication requires protection or not, you simply protect \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"all\"), \" communication, thus being on the safe side and increasing the level of privacy between all of your services and your consumers. Even the \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://https.cio.gov/everything/\"\n  }), \"US government stated\"), \":\"), mdx(\"blockquote\", null, mdx(\"p\", {\n    parentName: \"blockquote\"\n  }, \"Today, there is no such thing as non-sensitive web traffic\", \"[\", \"\\u2026\", \"]\")), mdx(\"p\", null, \"In this post I will talk about what you need to do to access your DiskStation over the internet through HTTPS. We are talking about your private device here, serving your private content over the internet. Because of this, the need to encrypt the communication between you and your DiskStation, from wherever you might access it (like from a hotel\\u2019s public Wi-Fi), should be a no-brainer. If you want to follow along, please make sure your DiskStation is accessible over the internet already through HTTP. In case you need help with that, have a look at \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://help.synology.com/dsm/?section=DSM&version=5.2&link=AdminCenter%2Fconnection_ddns.html\"\n  }), \"how to configure DDNS\"), \" and \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://help.synology.com/dsm/?section=DSM&version=5.2&link=AdminCenter%2Fconnection_routerconf.html\"\n  }), \"how to setup port forwarding rules\"), \".\"), mdx(\"h2\", {\n    \"id\": \"what-about-a-self-signed-certificate\"\n  }, \"What about a self-signed certificate?\"), mdx(\"p\", null, \"As you might know, you can issue a self-signed certificate directly in DSM. So you might ask yourself: \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"Why should I need a real certificate signed by a trusted certificate authority?\"), \" Well, your self-signed certificate will not be trusted by common web browsers, because you are not recognized as a trustworthy certificate authority and thus whenever someone accesses services on your NAS with a web browser they will be presented with a warning. If your NAS is only about your private content and only you (and maybe your family) accessing it over the internet, you might be fine with this or you are willing to add your certificate to the trust store of every device that you and your family use to access your NAS.\"), mdx(\"h2\", {\n    \"id\": \"lets-encrypt-to-the-rescue\"\n  }, \"Let\\u2019s Encrypt to the rescue\"), mdx(\"p\", null, mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://letsencrypt.org/\"\n  }), \"Let\\u2019s Encrypt\"), \" is a new, free, automated and open certificate authority and their declared goal is\"), mdx(\"blockquote\", null, mdx(\"p\", {\n    parentName: \"blockquote\"\n  }, \"to make it possible to set up an HTTPS server and have it automatically obtain a browser-trusted certificate, without any human intervention.\")), mdx(\"p\", null, \"Thanks to their efforts and the ACME\\xA0protocol it is not as hard as it used to be to get a genuine certificate, even for your very own DiskStation using a DDNS domain and the certificates signed by Let\\u2019s Encrypt are trusted by all major browsers, too. There are \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.metachris.com/2015/12/comparison-of-10-acme-lets-encrypt-clients/\"\n  }), \"several clients already available\"), \", however none of them run directly on a DiskStation as far as I know. So for now I decided to use the official Let\\u2019s Encrypt client in manual mode on my Linux desktop and import the generated certificate to the DiskStation. It is still quite easy to do. Just keep reading to find out how.\"), mdx(\"h2\", {\n    \"id\": \"lets-encrypt-clients-manual-mode\"\n  }, \"Let\\u2019s Encrypt client\\u2019s manual mode\"), mdx(\"p\", null, \"Let\\u2019s Encrypt managed to establish a wonderful community that is very active and ready to help. In fact I found the solution to get a certificate for my Synology DiskStation despite not being able to run the Let\\u2019s Encrypt client directly on the NAS in their community forum. Have a look at \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://community.letsencrypt.org/t/synology-nas-using-le-as-a-ca-signing-authority/453/15\"\n  }), \"dip987\\u2019s step-by-step guide\"), \" over there. Since Let\\u2019s Encrypt is in open beta now you don\\u2019t even need to sign up and can skip step 1 and 2 in dip987\\u2019s guide. In essence, you take these steps:\"), mdx(\"ol\", null, mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Get the client on a Linux OS by doing: \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"git clone https://github.com/letsencrypt/letsencrypt\")), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Use the client in manual mode like this: \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"./letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory certonly -a manual\"), \" and type in your domain name when asked\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"You will be asked to create a file with a specific name and content and to make it available with a specific URL on your domain, e.g.: \", mdx(\"em\", {\n    parentName: \"li\"\n  }, mdx(\"a\", _extends({\n    parentName: \"em\"\n  }, {\n    \"href\": \"http://melo.myds.me/.well-known/acme-challenge/%5C\"\n  }), \"http://melo.myds.me/.well-known/acme-challenge/\\\\\"), \"<filename\", \">\"), \" So login to DSM, start FileStation, open the web folder and create the .well-known/acme-challenge folders. For the file itself\\xA0I recommend using DSM\\u2019s Text Editor and double check you use UTF-8 when saving the file\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Grab privkey.pem, cert.pem and chain.pem following the symlinks in /etc/letsencrypt/live\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Import the pem files to your DiskStation at \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Control Panel\"), \" > \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Security\"), \" > \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Certificate\"), \". \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Private key\"), \" uses privkey.pem, \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Certificate\"), \" uses cert.pem and \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"Intermediate certificate\"), \" needs chain.pem\"), mdx(\"li\", {\n    parentName: \"ol\"\n  }, \"Make sure to include the /etc/letsencrypt folder to your scheduled backup\")), mdx(\"p\", null, \"Congratulations! You can now visit your DiskStation services like DSM and access whatever you might have inside the web folder using HTTPS.\"), mdx(\"h2\", {\n    \"id\": \"outlook\"\n  }, \"Outlook\"), mdx(\"p\", null, \"We saw how to secure access to our DiskStation with a valid certificate. For certificate renewal you can use exactly the same steps as for the initial certificate creation. However this is a manual process for now, but don\\u2019t worry: Synology will be supporting Let\\u2019s Encrypt and the ACME protocol in the near future and is actually already doing so in the current \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.synology.com/en-us/dsm/6.0beta/ReleaseNote\"\n  }), \"DSM 6 beta\"), \". This is great news, since we soon will be able to have the entire process of creating and renewing trusted certificates for secure access to our NAS right inside DSM with the click of a button! In case you also use Tomcat: Stick around for my next post where I will show the steps required to use HTTPS for your Tomcat apps on your DiskStation.\"));\n}\n;\nMDXContent.isMDXComponent = true;","slug":"/get-https-on-diskstation-with-lets-encrypt/","title":"Get HTTPS on DiskStation with Let's Encrypt","tags":[],"keywords":[],"date":"January 28, 2016"},"previous":{"__typename":"MdxBlogPost","id":"23414b50-56eb-5a04-9086-9677e3f48871","excerpt":"This is only my second post and I started only 3 weeks ago, but I have been wondering ever since about one question: Would people actually…","slug":"/piwik-and-wordpress-on-synology-dsm/","title":"Piwik and WordPress on Synology DSM","date":"January 10, 2016"},"next":{"__typename":"MdxBlogPost","id":"703f4203-112a-57c0-9975-ecd2b70d909c","excerpt":"In my  last blog post  I described the benefits of HTTPS and how to set up your Synology DiskStation to use HTTPS with a trusted certificate…","slug":"/lets-encrypt-for-tomcat-7-on-ds/","title":"HTTPS for Tomcat 7 with Let's Encrypt","date":"February 13, 2016"}},"pageContext":{"isCreatedByStatefulCreatePages":false,"id":"fc826d5e-b7dd-534f-ba51-b58e5b7fdecb","previousId":"23414b50-56eb-5a04-9086-9677e3f48871","nextId":"703f4203-112a-57c0-9975-ecd2b70d909c"}}}