Synology NAS Deployment

Use the dedicated Synology image to import and update certificates through the DSM API. This guide uses Container Manager and environment variables; no Dockerfile or agent configuration file is required.

Prerequisites

• The NAS supports Container Manager or Docker and can run Linux AMD64 or ARM64 containers.
• You have created a deployment node, associated certificates, and obtained its node ID and Token.
• You have a DSM HTTPS address reachable from the container and a DSM account with certificate-management permissions.
• Record the certificates currently assigned to DSM services so you can update those assignments after the first import. If the account uses MFA, confirm that its login policy supports unattended deployment.

By default, the agent synchronizes all associated certificates, creating or updating a separate CertOne-<certificate-id> entry for each one. After the first import, assign these certificates to the appropriate DSM services. Later updates reuse the same entries.

1. Download the image

In Container Manager, download the dedicated Synology image:

uswccr.ccs.tencentyun.com/certone/certone-synology:2026-10-28-01

The image supports Linux AMD64 and ARM64; Docker selects the matching architecture. If the registry requires authentication, configure its credentials in Container Manager before pulling the image.

2. Create the container and enter parameters

Copy the node ID and Token from the platform. Enter these variables in Container Manager:

Variable	Value
CERTONE_NODE_ID	Platform node ID
CERTONE_TOKEN	Token for this node
CERTONE_DSM_URL	NAS HTTPS address, such as https://nas.example.com:5001
CERTONE_DSM_USERNAME	DSM account with certificate-management permissions
CERTONE_DSM_PASSWORD	DSM account password

Only these five variables are required. By default, CERTONE_DSM_DESCRIPTION=CertOne-{id} and CERTONE_DSM_CREATE=true create one entry per certificate. Leave these defaults for the first installation.

The image already selects Synology deployment mode and connects to the CertOne platform automatically.

3. Configure persistence and start

Mount a NAS directory (for example /volume1/docker/certone) at /root/.certone with read/write access. Enable automatic restart, start the container, and inspect its logs. No container ports need to be published: CertOne initiates its connections to the platform and DSM.

The dedicated image runs as root, so ~/.certone resolves to /root/.certone, following the same directory rules as a local installation. The persistent state/ directory stores instance identity, cached certificates, and recovery records. Certificates are imported through the DSM API, so a certificates/ output directory is not required. Environment-variable mode does not generate a configuration file; logs are available in the container management interface.

Do not enable privileged mode or mount the Docker socket. Retain the state directory and mount the same directory when upgrading.

4. Verify the active certificates

1. Check the container logs for successful connection, authentication, and certificate import.
2. In DSM certificate management, verify the domain names, expiration dates, and descriptions.
3. Check which certificate each DSM service uses, then visit the actual HTTPS service to verify the result.

A successful import does not automatically switch every service to that certificate. Check service assignments, especially when creating a certificate entry for the first time.

Common issues

Start with the Container Manager log view. If the container is running, its terminal can run certone check --env and certone doctor --network --env. The network check verifies the platform connection, not DSM login. An actual certificate deployment is required to verify DSM permissions and imports.

After correcting environment variables, recreate the container with the same data directory. Restarting an old container does not load changes from an env file.

• Cannot connect to DSM: 127.0.0.1 inside the container usually is not the NAS. Use a reachable NAS address.
• HTTPS verification fails: The hostname must match the certificate, and the certificate must be valid. For a private CA, mount its CA file read-only and set CERTONE_DSM_CA_FILE.
• Target certificate not found: Use CertOne-{id} with CERTONE_DSM_CREATE=true. To update a specific existing entry, use the advanced configuration.
• Password or permission errors: The platform Token and DSM password are different credentials. The DSM account needs certificate-management permissions.
• MFA is enabled: A fixed one-time code cannot support unattended login indefinitely. Check the DSM login policy.
• Import succeeds but a service still uses the old certificate: Check its DSM certificate assignment and the endpoint being accessed.

Optional: Docker Compose

Compose can replace the interface-based setup above. Save the following as compose.yaml and create a neighboring .env file containing the environment variables from step 2. Use the complete example below.

services:
  certone:
    image: uswccr.ccs.tencentyun.com/certone/certone-synology:2026-10-28-01
    init: true
    restart: unless-stopped
    environment:
      CERTONE_DEPLOY_TYPE: synology
      CERTONE_NODE_ID: ${CERTONE_NODE_ID:?Set node ID}
      CERTONE_TOKEN: ${CERTONE_TOKEN:?Set node Token}
      CERTONE_DSM_URL: ${CERTONE_DSM_URL:?Set DSM URL}
      CERTONE_DSM_USERNAME: ${CERTONE_DSM_USERNAME:?Set DSM username}
      CERTONE_DSM_PASSWORD: ${CERTONE_DSM_PASSWORD:?Set DSM password}
      CERTONE_DSM_DESCRIPTION: "CertOne-{id}"
      CERTONE_DSM_CREATE: "true"
    volumes:
      - ./certone:/root/.certone
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: '5'

Example .env (replace every placeholder):

CERTONE_NODE_ID=node-REPLACE
CERTONE_TOKEN='REPLACE_WITH_NODE_TOKEN'
CERTONE_DSM_URL=https://nas.example.com:5001
CERTONE_DSM_USERNAME=certone-admin
CERTONE_DSM_PASSWORD='REPLACE_WITH_DSM_PASSWORD'

If authentication is required, first run docker login uswccr.ccs.tencentyun.com to grant Docker access to the image. Then start the service:

docker compose up -d
docker compose logs --tail 100 certone

Compose interprets variables and comments in .env files. Single-quote passwords containing characters such as $ or #, or enter them directly in Container Manager. Do not commit these files to a public repository.

Set CERTONE_DSM_CREATE=true only when you intend to allow creation of missing certificate entries.

For certificate selection, private CAs, OTP, and configuration-file deployment, see the Synology Configuration Reference. For connection or deployment failures, see Troubleshooting.