Security and SSL

[icegood 12]

there are many manual work here. Could we raise a bug to emby so that letsencrypt certificate that created under DSM panel would be accessible for emby as service?

[dawidd 0]

ups

Edited October 9, 2024 by dawidd

[Helerson 2]

I'll show you how to easily create a PFX certificate with automatic renewal for Emby on Synology 7.2:

• I assume you already have your own domain.
• Next, in Synology - Control Panel - Security - Certificates, create a new certificate using Let's Encrypt for your domain "website.com."
• Next, a short command via SSH or Synology - Control Panel - Task Scheduler - User-defined Script as root, which is used to extract certificates from Synology:
  
  cp -Rf /usr/syno/etc/certificate/ /volume1/homes/
  
  In this way, you will copy all the Synology certificates to the homes folder. Now, you need to find location of the certificate you created earlier for your domain. A helpful tool for this is the website where you can decode the .pem file: https://certlogik.com/decoder/. So, go to homes/certificate/_archive and check folder by folder. Edit the .pem file, copy its content, and paste it into the provided website to decode the certificate. Now, you know the location of the desired certificate. You need folder name for later mine is AaJQI1 
   
• In Synology - Control Panel - Task Scheduler, create a new Scheduled Task - User-defined Script (in the General tab, set User: root, and in the Schedule tab, set it to 3 months so that the certificate is renewed in proportion to the validity of the Let's Encrypt certificate for your domain. In the  Task Settings, paste the following script: asuming that your homes is at volume1
   
• cp -Rf /usr/syno/etc/certificate/ /volume1/homes/
  cd /volume1/homes/certificate/_archive/AaJQI1
  sudo openssl pkcs12 -export -out cert.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -passout pass:yourpassword
  synopkg restart EmbyServer
  
  AaJQI1 - this is my folder, you will have a different one. Don’t forget to change it in your script  
   
• Next, go to Emby Settings - Network and set the certificate location to volume1/homes/certificate/_archive/Your folder.

 

That's it! Personally, for aesthetic reasons, I don't keep this in the homes folder but in the Emby folder, so my script looks a bit different.

 

cp -Rf /usr/syno/etc/certificate/ /volume1/@appdata/EmbyServer/

cd /volume1/@appdata/EmbyServer/certificate/_archive/AaJQI1

sudo openssl pkcs12 -export -out cert.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -passout pass:yourpassword

chown -R emby:emby /volume1/@appdata/EmbyServer/certificate

synopkg restart EmbyServer

Good luck!

[Luke 42077]

On 10/9/2024 at 6:21 AM, dawidd said:

ups

Hi @dawidddo you have a question?