Synology Support Broken with 3.0.7 - Unable to auth - Works fine with 3.0.6

[war59312]

Synology 2 Factor Support Broken? - Unable to auth - Worked 1 Month Ago

This worked fine a month ago. Made sure correct SYNO_Device_ID is set and it is, Can see it in the URL requested.

---

Debug log

acme.sh --deploy --insecure -d mydomain.com --deploy-hook synology_dsm --debug 2
[Mon Jul 31 09:36:40 EDT 2023] Lets find script dir.
[Mon Jul 31 09:36:40 EDT 2023] _SCRIPT_='/usr/local/share/acme.sh/acme.sh'
[Mon Jul 31 09:36:40 EDT 2023] _script='/usr/local/share/acme.sh/acme.sh'
[Mon Jul 31 09:36:40 EDT 2023] _script_home='/usr/local/share/acme.sh'
[Mon Jul 31 09:36:40 EDT 2023] Using config home:/usr/local/share/acme.sh
[Mon Jul 31 09:36:40 EDT 2023] LE_WORKING_DIR='/usr/local/share/acme.sh'
https://github.com/acmesh-official/acme.sh
v3.0.7
[Mon Jul 31 09:36:40 EDT 2023] Running cmd: deploy
[Mon Jul 31 09:36:40 EDT 2023] Using config home:/usr/local/share/acme.sh
[Mon Jul 31 09:36:40 EDT 2023] default_acme_server
[Mon Jul 31 09:36:40 EDT 2023] ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
[Mon Jul 31 09:36:40 EDT 2023] _ACME_SERVER_HOST='acme.zerossl.com'
[Mon Jul 31 09:36:40 EDT 2023] _ACME_SERVER_PATH='v2/DV90'
[Mon Jul 31 09:36:40 EDT 2023] DOMAIN_PATH='/usr/local/share/acme.sh/mydomain.com'
[Mon Jul 31 09:36:40 EDT 2023] DOMAIN_CONF='/usr/local/share/acme.sh/mydomain.com/mydomain.com.conf'
[Mon Jul 31 09:36:40 EDT 2023] _deployApi='/usr/local/share/acme.sh/deploy/synology_dsm.sh'
[Mon Jul 31 09:36:40 EDT 2023] _cdomain='mydomain.com'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Username='Cert'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Password='[hidden](please add '--output-insecure' to see this value)'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Create
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Device_Name
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Scheme='https'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Hostname='localhost'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Port='2053'
[Mon Jul 31 09:36:40 EDT 2023] SYNO_Certificate='nas.mydomain.com'
[Mon Jul 31 09:36:40 EDT 2023] _base_url='https://localhost:2053'
[Mon Jul 31 09:36:40 EDT 2023] Getting API version
[Mon Jul 31 09:36:40 EDT 2023] GET
[Mon Jul 31 09:36:40 EDT 2023] url='https://localhost:2053/webapi/query.cgi?api=SYNO.API.Info&version=1&method=query&query=SYNO.API.Auth'
[Mon Jul 31 09:36:40 EDT 2023] timeout=
[Mon Jul 31 09:36:40 EDT 2023] _CURL='curl --silent --dump-header /usr/local/share/acme.sh/http.header  -L  --trace-ascii /tmp/tmp.qU7Axm2GR2  -g  --insecure  '
[Mon Jul 31 09:36:41 EDT 2023] ret='0'
[Mon Jul 31 09:36:41 EDT 2023] Logging into localhost:2053
[Mon Jul 31 09:36:41 EDT 2023] GET
[Mon Jul 31 09:36:41 EDT 2023] url='https://localhost:2053/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&format=sid&account=accountt&passwd=passwd&enable_syno_token=yes&device_name=&device_id=device_id'
[Mon Jul 31 09:36:41 EDT 2023] timeout=
[Mon Jul 31 09:36:41 EDT 2023] _CURL='curl --silent --dump-header /usr/local/share/acme.sh/http.header  -L  --trace-ascii /tmp/tmp.JnYY0sYGxd  -g  --insecure  '
[Mon Jul 31 09:36:41 EDT 2023] ret='0'
[Mon Jul 31 09:36:41 EDT 2023] Session ID
[Mon Jul 31 09:36:41 EDT 2023] SynoToken
[Mon Jul 31 09:36:41 EDT 2023] Unable to authenticate to https://localhost:2053 - check your username & password.
[Mon Jul 31 09:36:41 EDT 2023] If two-factor authentication is enabled for the user, set SYNO_Device_ID.
[Mon Jul 31 09:36:41 EDT 2023] Error deploy for domain:mydomain.com
[Mon Jul 31 09:36:41 EDT 2023] Deploy error.

Edit: Hell, even if I turn off 2 factor for the account I still get the same error. So for sure, something has broken. See in an email it was last successful back on July 10 with version 3.0.6. See now on version 3.0.7.

Edit 2: Confirmed, 3.0.7 breaks it. Went back to 3.0.6 and success.

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[war59312]

Confirmed, 3.0.7 breaks it. Went back to 3.0.6 and success.

EditL Well, see something else changed as well with wildcard.

As per #4621

Below will work when using a wildcard cert:

acme.sh --issue --dns dns_cf --server letsencrypt -k 2048 -d *.domain.com

Notice the -k 2048 that makes it work. No more a ecc cert.

[Eagle3386]

@war59312
First of all, your current debug log shows your admin user's password in plaintext - you should redact this immediately & change it ASAP.

Secondly, if

acme.sh --issue --dns dns_cf --server letsencrypt -k 2048 -d *.domain.com

works, but not with --ecc -k ec-256, then it's not a fault of the updated deploy hook, but with DSM and/or your general config/setup.
That's because the deploy hook doesn't even care which certificate type (ECC or old RSA) is used - it just deploys the certificate to DSM via its API.

Thirdly, there's no value for SYNO_Device_Name set, not even the default CertRenewal - that won't work.

Additionally, I suggest you to clean your configuration from lines regarding deployment, i.e. those with _DID, _SECRET & _Device_ in it & then configure deployment from scratch according to the updated wiki page.

Lastly, there's no point in using https, localhost & then inverting security by using --insecure.
In fact, there's no TLS encryption at all, because there's simply no certificate for localhost, hence no encryption is used - ever!

[Eagle3386]

Just noticed, the OP is using ZeroSSL - which seems to be broken, at least according to #4723.
That might as well cause problems which in turn caused the deploy hook to fail.

[war59312]

Thanks. Yeah this was just a quick example log.

Indeed, not calling to localhost, using real IP. Cleaned log. Thanks. Not real passwords anyways.

Just know the behavior of this is different between versions 3.0.6 and 3.0.7. Works as expected in version 3.0.6.

[Eagle3386]

Using real IP is still not much better. Use a domain name as that's what LE certificates are issued for.

Also, why are you still on DSM 6 instead of 7?

[war59312]

RGR, confirms works either way (FQDN vs IP) with 3.0.6; Thanks.

As for why DSM 6, it's an older DS1815+ that still works great. Don't fix what ant broke.

[Eagle3386]

As for why DSM 6, it's an older DS1815+ that still works great. Don't fix what ant broke.

Nope, wrong! Each & every person has to fix what's broken or outdated if it improves security - which is the case here as there's even DSM 7.2 available for your "old" DS1815+: https://www.synology.com/de-de/releaseNote/DSM?model=DS1815%2B

Among many things, this brings an updated Nginx as well as OpenSSL which both finally support ECC-based certificates - which alone is enough to force you to upgrade. Right. Now.

At least that's my point of view & I designed the new hook for security, not laziness.

[war59312]

Now that Synonology made it easy to upgrade. Now 7.1 appears as an upgrade option within the web console.

I went ahead and upgraded. Looking good.

Either way, sadly support is near the end... Note 7.2 is not supported.

For the following models, DSM 7.1 will be the last upgradable version. ... DS1815+

[Eagle3386]

At least 7.1 is supported, hence you've got Nginx with OCSP as well as OpenSSL with ECC support & therefore can switch to an ECC-based certificate for improved security with less resources consumed upon each HTTPS request.

And last, but not least: the deployment script should work flawlessly for you now, too! 🥳

[war59312]

I'll give it a shot, thanks.

[Eagle3386]

Thanks, @war59312!
As a kind hint: Please report any issue in #2727 as that's the deployment hook's "official" bug issue. 😉

[SiuKam]

Recently got a problem when deploy to DSM 6.2.3-25426 Update 3.
In my case, the syno webapi indicate to use the api of "auth.cgi", as follows:

[Thu Sep  7 13:17:57 CST 2023] response='{"data":{"SYNO.API.Auth":{"maxVersion":6,"minVersion":1,"path":"auth.cgi"}},"success":true}'

While the acme.sh decided to use the api of "entry.cgi", as follows:

[Thu Sep  7 13:19:24 CST 2023] url='http://***:***/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&format=sid&account=***&passwd=***&otp_code=***&enable_syno_token=yes&enable_device_token=yes&device_name=CertRenewal'

And get a error code of 102, which accordin to Synology Knowledge Center refers to The requested API does not exist.
Hope to get help.
And the full debug log as follows:

acme.sh --deploy --deploy-hook synology_dsm -d xxx.xx --debug 3
[Thu Sep  7 13:17:56 CST 2023] readlink exists=0
[Thu Sep  7 13:17:56 CST 2023] dirname exists=0
[Thu Sep  7 13:17:56 CST 2023] Lets find script dir.
[Thu Sep  7 13:17:56 CST 2023] _SCRIPT_='/root/.acme.sh/acme.sh'
[Thu Sep  7 13:17:56 CST 2023] _script='/root/.acme.sh/acme.sh'
[Thu Sep  7 13:17:56 CST 2023] _script_home='/root/.acme.sh'
[Thu Sep  7 13:17:56 CST 2023] Using default home:/root/.acme.sh
[Thu Sep  7 13:17:56 CST 2023] Using config home:/acme.sh
[Thu Sep  7 13:17:56 CST 2023] ACCOUNT_CONF_PATH='/acme.sh/account.conf'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 1:AUTO_UPGRADE='1'
[Thu Sep  7 13:17:56 CST 2023] LE_WORKING_DIR='/root/.acme.sh'
https://github.com/acmesh-official/acme.sh
v3.0.7
[Thu Sep  7 13:17:56 CST 2023] Running cmd: deploy
[Thu Sep  7 13:17:56 CST 2023] Using config home:/acme.sh
[Thu Sep  7 13:17:56 CST 2023] ACCOUNT_CONF_PATH='/acme.sh/account.conf'
[Thu Sep  7 13:17:56 CST 2023] default_acme_server
[Thu Sep  7 13:17:56 CST 2023] ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
[Thu Sep  7 13:17:56 CST 2023] _ACME_SERVER_HOST='acme.zerossl.com'
[Thu Sep  7 13:17:56 CST 2023] _ACME_SERVER_PATH='v2/DV90'
[Thu Sep  7 13:17:56 CST 2023] CA_CONF='/acme.sh/ca/acme.zerossl.com/v2/DV90/ca.conf'
[Thu Sep  7 13:17:56 CST 2023] The domain 'xxx.xx' seems to have a ECC cert already, lets use ecc cert.
[Thu Sep  7 13:17:56 CST 2023] DOMAIN_PATH='/acme.sh/xxx.xx_ecc'
[Thu Sep  7 13:17:56 CST 2023] DOMAIN_CONF='/acme.sh/xxx.xx_ecc/xxx.xx.conf'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 16:Le_DeployHook='synology_dsm,'
[Thu Sep  7 13:17:56 CST 2023] _deployApi='/root/.acme.sh/deploy/synology_dsm.sh'
[Thu Sep  7 13:17:56 CST 2023] synology_dsm_deploy exists=0
[Thu Sep  7 13:17:56 CST 2023] _cdomain='xxx.xx'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Username='xxx'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Password='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Create
[Thu Sep  7 13:17:56 CST 2023] SYNO_Device_Name
[Thu Sep  7 13:17:56 CST 2023] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 17:SAVED_SYNO_Scheme='http'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 18:SAVED_SYNO_Hostname='xxx'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 19:SAVED_SYNO_Port='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Scheme='http'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Hostname='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Port='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Certificate
[Thu Sep  7 13:17:57 CST 2023] _base_url='http://xxx:xxx'
[Thu Sep  7 13:17:57 CST 2023] Getting API version
[Thu Sep  7 13:17:57 CST 2023] GET
[Thu Sep  7 13:17:57 CST 2023] url='http://xxx:xxx/webapi/query.cgi?api=SYNO.API.Info&version=1&method=query&query=SYNO.API.Auth'
[Thu Sep  7 13:17:57 CST 2023] timeout=
[Thu Sep  7 13:17:57 CST 2023] curl exists=0
[Thu Sep  7 13:17:57 CST 2023] mktemp exists=0
[Thu Sep  7 13:17:57 CST 2023] wget exists=0
[Thu Sep  7 13:17:57 CST 2023] _CURL='curl --silent --dump-header /acme.sh/http.header  -L  --trace-ascii /tmp/tmp.VBTp2ix2AP  -g '
[Thu Sep  7 13:17:57 CST 2023] ret='0'
[Thu Sep  7 13:17:57 CST 2023] response='{"data":{"SYNO.API.Auth":{"maxVersion":6,"minVersion":1,"path":"auth.cgi"}},"success":true}'
[Thu Sep  7 13:17:57 CST 2023] api_version='6'
[Thu Sep  7 13:17:57 CST 2023] Logging into xxx:xxx
[Thu Sep  7 13:17:57 CST 2023] od exists=0
[Thu Sep  7 13:17:57 CST 2023] _url_encode
[Thu Sep  7 13:17:57 CST 2023] _hex_str=' 67 61 6e'
[Thu Sep  7 13:17:57 CST 2023] od exists=0
[Thu Sep  7 13:17:57 CST 2023] _url_encode
[Thu Sep  7 13:17:57 CST 2023] _hex_str=' 73 5a 2e 58 72 50 2a 32 6e 71 47 33'
Enter OTP code for user 'gan': 555026
Enter device name or leave empty for default (CertRenewal):
[Thu Sep  7 13:19:24 CST 2023] GET
[Thu Sep  7 13:19:24 CST 2023] url='http://xxx:xxx/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&format=sid&account=xxx&passwd=xxx&otp_code=xxx&enable_syno_token=yes&enable_device_token=yes&device_name=CertRenewal'
[Thu Sep  7 13:19:24 CST 2023] timeout=
[Thu Sep  7 13:19:24 CST 2023] curl exists=0
[Thu Sep  7 13:19:24 CST 2023] mktemp exists=0
[Thu Sep  7 13:19:24 CST 2023] wget exists=0
[Thu Sep  7 13:19:24 CST 2023] _CURL='curl --silent --dump-header /acme.sh/http.header  -L  --trace-ascii /tmp/tmp.PW67fLUFdj  -g '
[Thu Sep  7 13:19:24 CST 2023] ret='0'
[Thu Sep  7 13:19:24 CST 2023] response='{"error":{"code":102},"success":false}'
[Thu Sep  7 13:19:24 CST 2023] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:19:24 CST 2023] Session ID
[Thu Sep  7 13:19:24 CST 2023] SynoToken
[Thu Sep  7 13:19:24 CST 2023] Unable to authenticate to http://xxx:xxx - check your username & password.
[Thu Sep  7 13:19:24 CST 2023] If two-factor authentication is enabled for the user, set SYNO_Device_ID.
[Thu Sep  7 13:19:24 CST 2023] Error deploy for domain:xxx.xx
[Thu Sep  7 13:19:24 CST 2023] Deploy error.