Handling multiple TLDs (Synology)

[Wishville]

Hi.

have been using acme.sh for a bout a year now to create a wildcard cert for use in my Synology NAS which sits behind Cloudflare.
Auto renew scripts are working well, so this has been pain free for a good while now.

Until now...

I have been attempting to rerun the process for a SECOND domain, but just running into issues that are beyond me.

Both domains are in Cloudflare so no issues with acquiring the certificates; issue is seen when attempting to deploy, e.g

Unable to find certificate: domain.com and $SYNO_Create is not set

Should I be creating a single certificate with both domains in it? e.g.

./acme.sh --issue -d domain1.co.uk -d *.domain1.co.uk -d domain2.com -d *.domain2.com --dns "$CERT_DNS"

I'd prefer to have two separate certs so there is no obvious connection between the two?

Suspect that this is me just not RTFM properly, but if someone could pint out the obvious error I am making, that would be great

TIA

Mik

[Wishville]

This discussion area is going well, isn't it :D

Do I need to have multiple acme.sh installations? One for each domain I wish to manage? like:

$ ./acme.sh --install --nocron --home /usr/local/share-domain1/acme.sh --accountemail "email@domain1.com"
$ ./acme.sh --install --nocron --home /usr/local/share-domain2/acme.sh --accountemail "email@domain2.com"

and then basically repeat the setup instructions in each installed location?

Ta.

[AlvinSchiller]

This should be working without the need to use a single certificate or a second installation.

Do you have acme.sh installed directly on the NAS or docker?
Did you follow https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide#https-certificates-for-your-synology-nas-using-acmesh initially?
Have you set the export values again for the additional certificate (https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide#deploying-additional-certificates)?

Can you post your steps for deploying?

[Wishville]

Hi,

Thanks for your assistance on this, answering your questions in turn:

• install is directly on NAS; not via docker.
• Yes; for the most part... I followed those instructions using Cloudflare API Key for DNS but on the "issue" step I set the wildcard as separate -d entry rather then using "$CERT_DOMAIN" like so:

$ ./acme.sh --issue -d mydomain.co.uk -d *.mydomain.co.uk --dns "$CERT_DNS"

• No; or not exactly... I was worried that the repeated export commands would override the ones initially set, which would then cause problems when setting auto renew. Also, as per above, it looked to me like that instruction was for adding additional subdomains

$ ./acme.sh --issue --home . -d "subdomain.$CERT_DOMAIN" --dns "$CERT_DNS"
# SYNO_Certificate is the description shown under Security -> Certificates in the DSM Control Panel
$ export SYNO_Certificate="A different certificate"
$ export SYNO_Create=1 # Says to create the certificate if it doesn't exist
$ ./acme.sh --deploy --home . -d "subdomain.$CERT_DOMAIN" --deploy-hook synology_dsm

where I want an entirely different certificate and TLD altogether.

Specifically I have mydomain.co.uk , mydomain.uk and anotherdomain.com

Thanks

[AlvinSchiller]

Ok then there is the problem.

No; or not exactly... I was worried that the repeated export commands would override the ones initially set, which would then cause problems when setting auto renew. ...

You need to export the deploy information for the new certificate.
The example is indeed for an additional subdomain, but as a whole new certificate, so much like in your case.

To make things clear with the export values:
The export values are only valid for the terminal instance and will be lost if the instance is closed (e.g. the NAS is restarted).
So after a successfull run all needed values are stored in files for the account and domain and will be available for the renewal process (even after restart).
You only override values if you export them and issue/deploy a domain. Another domain will not be affected by this run.
To be save you can "unset" all values after a successfull run, before working on another domain.
You only need seperate acme.sh installations if you need different account information for the same DNS provider, as these are global.

So to be more specific for your usecase:
You said the issuing was successfull so lets assume you have done something like this (i skip the $CERT_DNS export to be more clear):

./acme.sh --issue -d "mydomain.co.uk" -d "*.mydomain.co.uk" --dns dns_cf
./acme.sh --issue -d "mydomain.uk" -d "*.mydomain.uk" --dns dns_cf

This gives you two seperate certificates for "mydomain.co.uk" and "mydomain.uk".

For deploying to DSM you would be doing something like this:

export SYNO_Username='Admin_Username'
export SYNO_Password='Admin_Password!123'
export SYNO_Certificate="mydomain.co.uk"  #description of the certificate in DSM - see documentation
export SYNO_Create=1
#plus any other needed SYNO values
./acme.sh --deploy -d "mydomain.co.uk" --deploy-hook synology_dsm

All export SYNO values will be stored for the domain "mydomain.co.uk"

As you have the first domain already up and running this is already done.
So you need to set all values again for the second domain "mydomain.uk" (as they are most likely not exported anymore).
The most important part is to set a new certificate name, otherwise you would override the existing in DSM.

export SYNO_Username='Admin_Username'
export SYNO_Password='Admin_Password!123'
export SYNO_Certificate="mydomain.uk"  #description of the certificate in DSM - see documentation
export SYNO_Create=1
#plus any other needed SYNO values
./acme.sh --deploy -d "mydomain.uk" --deploy-hook synology_dsm

Now you should have both certificates in DSM and with a working auto renewal.
This can be repeated for any other seperate certificate, like "anotherdomain.com".

Hope this clears things up and gets you going.

[Wishville]

Perfect.

Thanks so, so much for clarifying on this - it's been driving me nuts!

[alidaf]

How does auto-renewal work with this when no schedules have been set up?