Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save bogdanrotariu/f6ac0d204d306b131b8ccb3ac253c8d8 to your computer and use it in GitHub Desktop.
Save bogdanrotariu/f6ac0d204d306b131b8ccb3ac253c8d8 to your computer and use it in GitHub Desktop.
CLI script to programmatically replace SSL certs on Synology NAS
#!/bin/sh
#
# *** For DSM v6.x ***
#
# How to use this script:
# 1. Get your 3 PEM files ready to copy over from your local machine/update server (privkey.pem, fullchain.pem, cert.pem)
# and put into a directory (this will be $CERT_DIRECTORY).
# 2. Ensure you have a user setup on synology that has ssh access (and ssh access is setup).
# This user will need to be able to sudo as root (i.e. add this line to sudoers, <USER> is the user you create):
# <USER> ALL=(ALL) NOPASSWD: /var/services/homes/<USER>/replace_certs.sh
# 3. Call this script as follows:
# sudo scp ${CERT_DIRECTORY}/{privkey,fullchain,cert}.pem $USER@$SYNOLOGY_SERVER:/tmp/ \
# && sudo scp replace_synology_ssl_certs.sh $USER@$SYNOLOGY_SERVER:~/ \
# && ssh $USER@$SYNOLOGY_SERVER 'sudo ./replace_synology_ssl_certs.sh'
# Script start.
REVERSE_PROXY=/usr/syno/etc/certificate/ReverseProxy
FQDN_DIR=/usr/syno/etc/certificate/system/FQDN
DEFAULT_DIR=
DEFAULT_DIR_NAME=$(cat /usr/syno/etc/certificate/_archive/DEFAULT)
if [ "DEFAULT_DIR_NAME" != "" ]; then
DEFAULT_DIR="/usr/syno/etc/certificate/_archive/${DEFAULT_DIR_NAME}"
fi
# Move certs from /tmp to install directory
mv /tmp/{privkey,fullchain,cert}.pem /usr/syno/etc/certificate/system/default/
if [ "$?" != 0 ]; then
echo "Halting because of error moving files"
exit 1
fi
# Ensure correct permissions
chown root:root /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem
if [ "$?" != 0 ]; then
echo "Halting because of error chowning files"
exit 1
fi
echo "Certs moved from /tmp & chowned."
# If you're using a custom domain name, replace the FQDN certs too
if [ -d "${FQDN_DIR}/" ]; then
echo "Found FQDN directory, copying certificates to 'certificate/system/FQDN' as well..."
cp /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem "${FQDN_DIR}/"
chown root:root "${FQDN_DIR}/"{privkey,fullchain,cert}.pem
fi
# Replace certs for default Application Portal (if found)
if [ -d "$DEFAULT_DIR" ]; then
echo "Found upload dir (used for Application Portal): $DEFAULT_DIR_NAME, copying certs to: $DEFAULT_DIR"
cp /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem "$DEFAULT_DIR/"
chown root:root "$DEFAULT_DIR/"{privkey,fullchain,cert}.pem
else
echo "Did not find upload dir (Application Portal): $DEFAULT_DIR_NAME"
fi
# Replace certs for all reverse proxy servers (if exists)
if [ -d "$REVERSE_PROXY" ]; then
echo "Found reverse proxy certs, replacing those:"
for proxy in $(ls "$REVERSE_PROXY"); do
echo "Replacing $REVERSE_PROXY/$proxy"
cp /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem "$REVERSE_PROXY/$proxy"
chown root:root "$REVERSE_PROXY/$proxy/"{privkey,fullchain,cert}.pem
done
else
echo "No reverse proxy directory found"
fi
# Reboot synology services
echo -n "Rebooting all the things..."
systemctl restart nginx
systemctl restart avahi
echo " done"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment