Can not deploy on Synology DSM 7,

[ywwzwb]

I Cannot deploy my cert to synology, the log complain me with password error, I can confirm that password is right.
My account is admin and 2FA-OTP is disabled.
Synology version: DSM 7.1-42661 Update 4

After I check the log with code, it seems that login is succeed but synology respond with a empty device_id.

  ➜  ~ acme.sh --deploy -d  example --deploy-hook synology_dsm --debug 3 --insecure
[Mon 28 Aug 2023 04:18:48 PM UTC] /homt/xyz/.acme.sh/acme.sh:_exists:534   readlink exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] /homt/xyz/.acme.sh/acme.sh:_exists:534   dirname exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] /homt/xyz/.acme.sh/acme.sh:__initHome:2646 Lets find script dir.
[Mon 28 Aug 2023 04:18:48 PM UTC] /homt/xyz/.acme.sh/acme.sh:__initHome:2647 _SCRIPT_='/homt/xyz/.acme.sh/acme.sh'
[Mon 28 Aug 2023 04:18:48 PM UTC] /homt/xyz/.acme.sh/acme.sh:__initHome:2649 _script='/homt/xyz/.acme.sh/acme.sh'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:__initHome:2651                  _script_home='/homt/xyz/.acme.sh'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:__initHome:2678                  Using config home:/homt/xyz/.acme.sh
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:__initHome:2692                  ACCOUNT_CONF_PATH='/homt/xyz/.acme.sh/account.conf'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_process:7843                    LE_WORKING_DIR='/homt/xyz/.acme.sh'
https://github.com/acmesh-official/acme.sh
v3.0.7
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_process:7851                    Running cmd: deploy
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:__initHome:2678                  Using config home:/homt/xyz/.acme.sh
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:__initHome:2692                  ACCOUNT_CONF_PATH='/homt/xyz/.acme.sh/account.conf'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2808                   default_acme_server
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2817                   ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2819                   _ACME_SERVER_HOST='acme.zerossl.com'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2822                   _ACME_SERVER_PATH='v2/DV90'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2829                   CA_CONF='/homt/xyz/.acme.sh/ca/acme.zerossl.com/v2/DV90/ca.conf'
[Mon 28 Aug 2023 04:18:48 PM UTC] The domain 'mydomain.com' seems to have a ECC cert already, lets use ecc cert.
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_initpath:2906                   DOMAIN_PATH='/homt/xyz/.acme.sh/mydomain.com_ecc'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:deploy:5771                      DOMAIN_CONF='/homt/xyz/.acme.sh/mydomain.com_ecc/mydomain.com.conf'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2305                     OK
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2329                     21:Le_DeployHook='synology_dsm,'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_deploy:5727                     _deployApi='/homt/xyz/.acme.sh/deploy/synology_dsm.sh'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      synology_dsm_deploy exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:38 _cdomain='mydomain.com'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:56 SYNO_Username='xyz'
[Mon 28 Aug 2023 04:18:48 PM UTC] SYNO_Password='[hidden](please add '--output-insecure' to see this value)'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:58 SYNO_Create
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:59 SYNO_Device_Name
[Mon 28 Aug 2023 04:18:48 PM UTC] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2305                     OK
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2329                     22:SAVED_SYNO_Scheme='https'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2305                     OK
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2329                     23:SAVED_SYNO_Hostname='192.168.11.22'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2305                     OK
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_setopt:2329                     24:SAVED_SYNO_Port='5001'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:75 SYNO_Scheme='https'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:76 SYNO_Hostname='192.168.11.22'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:77 SYNO_Port='5001'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:81 SYNO_Certificate
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:90 _base_url='https://192.168.11.22:5001'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:92 Getting API version
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_get:2034                        GET
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_get:2038                        url='https://192.168.11.22:5001/webapi/query.cgi?api=SYNO.API.Info&version=1&method=query&query=SYNO.API.Auth'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_get:2039                        timeout=
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      curl exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      mktemp exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      wget exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_get:2051                        _CURL='curl --silent --dump-header /homt/xyz/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.vkej2EaBFx  -g  --insecure  '
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_get:2103                        ret='0'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:95 response='{"data":{"SYNO.API.Auth":{"maxVersion":7,"minVersion":1,"path":"entry.cgi"}},"success":true}'
[Mon 28 Aug 2023 04:18:48 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:96 api_version='7'
[Mon 28 Aug 2023 04:18:48 PM UTC] Logging into 192.168.11.22:5001
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      od exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_url_encode:678                  _url_encode
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_url_encode:679                  _hex_str=' 00 00 00'
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_exists:534                      od exists=0
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_url_encode:678                  _url_encode
[Mon 28 Aug 2023 04:18:48 PM UTC] acme.sh:_url_encode:679                  _hex_str=' 00 00 00 00 00 00 00 00 00'
Enter OTP code for user 'xyz': 
Enter device name or leave empty for default (CertRenewal): 
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_get:2034                        GET
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_get:2038                        url='https://192.168.11.22:5001/webapi/entry.cgi?api=SYNO.API.Auth&version=7&method=login&format=sid&account=xyz&passwd=0000000&otp_code=&enable_syno_token=yes&enable_device_token=yes&device_name=CertRenewal'
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_get:2039                        timeout=
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_exists:534                      curl exists=0
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_exists:534                      mktemp exists=0
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_exists:534                      wget exists=0
[Mon 28 Aug 2023 04:18:53 PM UTC] acme.sh:_get:2051                        _CURL='curl --silent --dump-header /homt/xyz/.acme.sh/http.header  -L  --trace-ascii /tmp/tmp.mtxmuxVyJe  -g  --insecure  '
[Mon 28 Aug 2023 04:18:54 PM UTC] acme.sh:_get:2103                        ret='0'
[Mon 28 Aug 2023 04:18:54 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:137 response='{"data":{"account":"xyz","device_id":"","ik_message":"","is_portal_port":false,"sid":"***","synotoken":"*****"},"success":true}'
[Mon 28 Aug 2023 04:18:54 PM UTC] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Mon 28 Aug 2023 04:18:54 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:147 Session ID='***'
[Mon 28 Aug 2023 04:18:54 PM UTC] deploy/synology_dsm.sh:synology_dsm_deploy:148 SynoToken='jhDsj9EzMp9og'
[Mon 28 Aug 2023 04:18:54 PM UTC] Unable to authenticate to https://192.168.11.22:5001 - check your username & password.
[Mon 28 Aug 2023 04:18:54 PM UTC] If two-factor authentication is enabled for the user, set SYNO_Device_ID.
[Mon 28 Aug 2023 04:18:54 PM UTC] Error deploy for domain:mydomain.com
[Mon 28 Aug 2023 04:18:54 PM UTC] Deploy error.```

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[ywwzwb]

➜ ~ acme.sh --upgrade
[Mon 28 Aug 2023 04:26:34 PM UTC] Already uptodate!
[Mon 28 Aug 2023 04:26:34 PM UTC] Upgrade success!

[Saxfusion]

Deploy seems to be broken with Synology in v3.0.7.
(Also not stopping to be able to enter OTP code, no matter what the config looks like)
v3.0.6 working fine here.
Next renewal round coming up in december... wondering if it works again by then. :)

[SiuKam]

Similar problem with DSM 6.2.3-25426 Update 3
In my case, the syno webapi indicate to use the api of "auth.cgi", as follows:

[Thu Sep  7 13:17:57 CST 2023] response='{"data":{"SYNO.API.Auth":{"maxVersion":6,"minVersion":1,"path":"auth.cgi"}},"success":true}'

While the acme.sh decided to use the api of "entry.cgi", as follows:

[Thu Sep  7 13:19:24 CST 2023] url='http://***:***/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&format=sid&account=***&passwd=***&otp_code=***&enable_syno_token=yes&enable_device_token=yes&device_name=CertRenewal'

And get a error code of 102, which accordin to Synology Knowledge Center refers to The requested API does not exist.
Hope to be fixed soon.
And the full debug log as follows:

acme.sh --deploy --deploy-hook synology_dsm -d xxx.xx --debug 3
[Thu Sep  7 13:17:56 CST 2023] readlink exists=0
[Thu Sep  7 13:17:56 CST 2023] dirname exists=0
[Thu Sep  7 13:17:56 CST 2023] Lets find script dir.
[Thu Sep  7 13:17:56 CST 2023] _SCRIPT_='/root/.acme.sh/acme.sh'
[Thu Sep  7 13:17:56 CST 2023] _script='/root/.acme.sh/acme.sh'
[Thu Sep  7 13:17:56 CST 2023] _script_home='/root/.acme.sh'
[Thu Sep  7 13:17:56 CST 2023] Using default home:/root/.acme.sh
[Thu Sep  7 13:17:56 CST 2023] Using config home:/acme.sh
[Thu Sep  7 13:17:56 CST 2023] ACCOUNT_CONF_PATH='/acme.sh/account.conf'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 1:AUTO_UPGRADE='1'
[Thu Sep  7 13:17:56 CST 2023] LE_WORKING_DIR='/root/.acme.sh'
https://github.com/acmesh-official/acme.sh
v3.0.7
[Thu Sep  7 13:17:56 CST 2023] Running cmd: deploy
[Thu Sep  7 13:17:56 CST 2023] Using config home:/acme.sh
[Thu Sep  7 13:17:56 CST 2023] ACCOUNT_CONF_PATH='/acme.sh/account.conf'
[Thu Sep  7 13:17:56 CST 2023] default_acme_server
[Thu Sep  7 13:17:56 CST 2023] ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
[Thu Sep  7 13:17:56 CST 2023] _ACME_SERVER_HOST='acme.zerossl.com'
[Thu Sep  7 13:17:56 CST 2023] _ACME_SERVER_PATH='v2/DV90'
[Thu Sep  7 13:17:56 CST 2023] CA_CONF='/acme.sh/ca/acme.zerossl.com/v2/DV90/ca.conf'
[Thu Sep  7 13:17:56 CST 2023] The domain 'xxx.xx' seems to have a ECC cert already, lets use ecc cert.
[Thu Sep  7 13:17:56 CST 2023] DOMAIN_PATH='/acme.sh/xxx.xx_ecc'
[Thu Sep  7 13:17:56 CST 2023] DOMAIN_CONF='/acme.sh/xxx.xx_ecc/xxx.xx.conf'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 16:Le_DeployHook='synology_dsm,'
[Thu Sep  7 13:17:56 CST 2023] _deployApi='/root/.acme.sh/deploy/synology_dsm.sh'
[Thu Sep  7 13:17:56 CST 2023] synology_dsm_deploy exists=0
[Thu Sep  7 13:17:56 CST 2023] _cdomain='xxx.xx'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Username='xxx'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Password='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:17:56 CST 2023] SYNO_Create
[Thu Sep  7 13:17:56 CST 2023] SYNO_Device_Name
[Thu Sep  7 13:17:56 CST 2023] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 17:SAVED_SYNO_Scheme='http'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 18:SAVED_SYNO_Hostname='xxx'
[Thu Sep  7 13:17:56 CST 2023] OK
[Thu Sep  7 13:17:56 CST 2023] 19:SAVED_SYNO_Port='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Scheme='http'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Hostname='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Port='xxx'
[Thu Sep  7 13:17:57 CST 2023] SYNO_Certificate
[Thu Sep  7 13:17:57 CST 2023] _base_url='http://xxx:xxx'
[Thu Sep  7 13:17:57 CST 2023] Getting API version
[Thu Sep  7 13:17:57 CST 2023] GET
[Thu Sep  7 13:17:57 CST 2023] url='http://xxx:xxx/webapi/query.cgi?api=SYNO.API.Info&version=1&method=query&query=SYNO.API.Auth'
[Thu Sep  7 13:17:57 CST 2023] timeout=
[Thu Sep  7 13:17:57 CST 2023] curl exists=0
[Thu Sep  7 13:17:57 CST 2023] mktemp exists=0
[Thu Sep  7 13:17:57 CST 2023] wget exists=0
[Thu Sep  7 13:17:57 CST 2023] _CURL='curl --silent --dump-header /acme.sh/http.header  -L  --trace-ascii /tmp/tmp.VBTp2ix2AP  -g '
[Thu Sep  7 13:17:57 CST 2023] ret='0'
[Thu Sep  7 13:17:57 CST 2023] response='{"data":{"SYNO.API.Auth":{"maxVersion":6,"minVersion":1,"path":"auth.cgi"}},"success":true}'
[Thu Sep  7 13:17:57 CST 2023] api_version='6'
[Thu Sep  7 13:17:57 CST 2023] Logging into xxx:xxx
[Thu Sep  7 13:17:57 CST 2023] od exists=0
[Thu Sep  7 13:17:57 CST 2023] _url_encode
[Thu Sep  7 13:17:57 CST 2023] _hex_str=' 00 00 00'
[Thu Sep  7 13:17:57 CST 2023] od exists=0
[Thu Sep  7 13:17:57 CST 2023] _url_encode
[Thu Sep  7 13:17:57 CST 2023] _hex_str=' 00 00 00 00 00 00 00 00 00 00 00 00'
Enter OTP code for user 'xxx': 555026
Enter device name or leave empty for default (CertRenewal):
[Thu Sep  7 13:19:24 CST 2023] GET
[Thu Sep  7 13:19:24 CST 2023] url='http://xxx:xxx/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&format=sid&account=xxx&passwd=xxx&otp_code=xxx&enable_syno_token=yes&enable_device_token=yes&device_name=CertRenewal'
[Thu Sep  7 13:19:24 CST 2023] timeout=
[Thu Sep  7 13:19:24 CST 2023] curl exists=0
[Thu Sep  7 13:19:24 CST 2023] mktemp exists=0
[Thu Sep  7 13:19:24 CST 2023] wget exists=0
[Thu Sep  7 13:19:24 CST 2023] _CURL='curl --silent --dump-header /acme.sh/http.header  -L  --trace-ascii /tmp/tmp.PW67fLUFdj  -g '
[Thu Sep  7 13:19:24 CST 2023] ret='0'
[Thu Sep  7 13:19:24 CST 2023] response='{"error":{"code":102},"success":false}'
[Thu Sep  7 13:19:24 CST 2023] SYNO_Device_ID='[hidden](please add '--output-insecure' to see this value)'
[Thu Sep  7 13:19:24 CST 2023] Session ID
[Thu Sep  7 13:19:24 CST 2023] SynoToken
[Thu Sep  7 13:19:24 CST 2023] Unable to authenticate to http://xxx:xxx - check your username & password.
[Thu Sep  7 13:19:24 CST 2023] If two-factor authentication is enabled for the user, set SYNO_Device_ID.
[Thu Sep  7 13:19:24 CST 2023] Error deploy for domain:xxx.xx
[Thu Sep  7 13:19:24 CST 2023] Deploy error.

[ampersandru]

same issue with latest DSM6. Added DID to SYNO_Device_ID

[Thu Sep 14 16:54:17 UTC 2023] Logging into xx.xx.xxx
[Thu Sep 14 16:54:17 UTC 2023] Unable to authenticate to xx.xx.xxx - check your username & password.
[Thu Sep 14 16:54:17 UTC 2023] If two-factor authentication is enabled for the user, set SYNO_Device_ID.
[Thu Sep 14 16:54:17 UTC 2023] Error deploy for domain:xxxxxxxxxxx.net
[Thu Sep 14 16:54:17 UTC 2023] Deploy error.
[Thu Sep 14 16:54:17 UTC 2023] Error renew xxxxxxxxxx.net.
[Thu Sep 14 16:54:17 UTC 2023] ===End cron===

Downgraded to 3.0.6 and still having same issue

[wellblink]

我也有同样的问题

[nicobo01]

Hello,

I have this same problem with an account that is admin and whose double authentication is not activated.
Synology DS218+
DSM 7.1.1-42962 Update 6
acme.sh version 3.0.7

[meeces2911]

For anyone else looking, the fix is discussed at the end of #2727

[winromulus]

Fixed in #4809

[rsporsche]

FYI @ywwzwb , @SiuKam
Just want to let you know that the log file you posted contains your DSM username and password

[SiuKam]

FYI @ywwzwb , @SiuKam Just want to let you know that the log file you posted contains your DSM username and password

Pretty sure mine is taken cared of, thanks anyway.

[rsporsche]

@SiuKam Pretty sure is not 100% sure. I can 100% sure read a username and password from your log.

[SiuKam]

@SiuKam Pretty sure is not 100% sure. I can 100% sure read a username and password from your log.

the "password" you read is just an otp

[rsporsche]

@SiuKam

[Thu Sep 7 13:17:57 CST 2023] _hex_str=' 73 5a 2e 58 72 50 2a 32 6e 71 47 33'

[SiuKam]

@SiuKam

[Thu Sep 7 13:17:57 CST 2023] _hex_str=' 73 5a 2e 58 72 50 2a 32 6e 71 47 33'

got it. didn't notice the hex

[rsporsche]

I reported the issue with the hex strings leaking the password so I guess it'll be fixed at some point.

[SiuKam]

I reported the issue with the hex strings leaking the password so I guess it'll be fixed at some point.

appreciate it

[ywwzwb]

FYI @ywwzwb , @SiuKam Just want to let you know that the log file you posted contains your DSM username and password

Thank you for that, I will edit the log file and password