Trace: • dsm7inst

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
syno:dsm7inst [2026/08/22 19:11] – [KMIP for key management] Bernard Condrausyno:dsm7inst [2026/08/22 19:44] (current) – [KMIP for key management] Bernard Condrau
Line 8: Line 8:
 ===== KMIP for key management ===== ===== KMIP for key management =====
   * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client   * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client
-  * What this guide does not mention is how to generate working certificates for DSM 7.4 and later, which hardened the certificate requirements, so follow my guide here:+  * What this guide does not mention is how to generate working certificates for DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients, when added to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.
     - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4     - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4
     - Login to your NAS on the command line with SSH and elevate to root     - Login to your NAS on the command line with SSH and elevate to root
Line 14: Line 14:
     - Run the script as root:<file>bash gen_kmip_certs.sh kmip_certs</file>The second parameter //kmip_certs// is the name of a shared folder the script will create to store the certificates     - Run the script as root:<file>bash gen_kmip_certs.sh kmip_certs</file>The second parameter //kmip_certs// is the name of a shared folder the script will create to store the certificates
     - Upload the generated scripts in ''/volume1/kmip_certs'' to your local computer you use to access your DSMs through your web browser, after which you can remove the shared folder and it's content     - Upload the generated scripts in ''/volume1/kmip_certs'' to your local computer you use to access your DSMs through your web browser, after which you can remove the shared folder and it's content
-    - The script will generate the following certificates:<code></code>+    - The script will generate the following certificates:<code>ca-key.pem 
 +ca.pem 
 +client-fullchain.pem 
 +client-key.pem 
 +client.pem 
 +server-fullchain.pem 
 +server-key.pem 
 +server.pem</code>
     - On the server NAS     - On the server NAS
       * go to //Control Panel > Security > Certificate//       * go to //Control Panel > Security > Certificate//
Line 29: Line 36:
       * Add a port forward for port 5696 to your server NAS       * Add a port forward for port 5696 to your server NAS
     - On the client NAS     - On the client NAS
 +      * go to //Control Panel > Security > Certificate//
 +      * Click //Add//, choose //Import Certificate//, and upload:
 +        * Private key: ''client-key.pem''
 +        * Certificate: ''client.pem''
 +        * Leave Intermediate certificate empty
 +      * Click Settings (in the Certificate tab), find the //KMIP dropdown menu//, select this new client certificate, and click OK
       * Go to //Control Panel > Security > KMIP// and select //Set as remote key client//       * Go to //Control Panel > Security > KMIP// and select //Set as remote key client//
       * Enter the server's IP address and port 5696       * Enter the server's IP address and port 5696
       * Upload the certificate authority file ''ca.pem'' and click **Next**, they client will not attempt to connect to the server       * Upload the certificate authority file ''ca.pem'' and click **Next**, they client will not attempt to connect to the server
  
 +=== Links ===
 +  * [[https://www.google.com/search?q=did+anyone+successfully+connect+synology+nas+via+kmip+to+another+synology+nas+running+dsm+7.4&rlz=1C1CHBF_en-GBTH1186TH1186&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAtIBCTE5MjEyajBqN6gCCLACAfEFN9emBNraMWg&sourceid=chrome&ie=UTF-8&fbs=ABfTbFVyMZGZf1hfvX9uKjN_-G8cn05EoNqnRUpRtqDK_L3JtT0h7PdEdL8le1RT1QApqDkd9qUYylHBfgw4wakeGWmv-Mbbvk7Ub6Fdg7DBh9O7QsFZnQqnV9zcx0gw62oDY1ex_AdW6sBOijfYY0XJ8sj2hUtdKCTxahwspfYzssC-sJLA_YDa9IZrLaxl-SAAOY6mq7TWaFsDWE3bF68uIY9zOlZ1wg&aep=10&ntc=1&sxsrf=APpeQnuK5wlsuLaUTWsE9QuIsuh8yDmrQw%3A1787391169478&mstk=AUtExfDPfM2f40TnAL-610TT2CspEGepn6xcFrRJE0fBQYXhv5fi5Fn7T6EJOzICRpjzYwU4AuPrFY1IQpKcEoC5C2yasIJimNTh4wbJjetctoSIG17YpPPpsHoqONiDPwFAl_BJlvsqRdeYKvQnY7o12-KEb8qr67kmXdoL6beldPp94iZ2P42Jtzqb9jM8ic91q-uOFTjSoBPLRC2_mcJKXE2SbFo0jnRZBVTO0wbPksAaNC_mwajviaBxAl8NfHdgKcgyYI91WGcFQrnLVm3A1Jts-qiioo3jNLgyc7OCI5XgaC_kKrW54GjG6c0D6IIjDV8wPZnBVdP6TA&aioh=3&csuir=1&cs=1&atvm=2&udm=50&mtid=C22JatzHE72hseMPhYKfoAI|Updated security and certificate guidelines for DSM 7.4]]
 +  * [[https://www.google.com/search?q=instructions+for+synology+dsm+7.4+kmip&rlz=1C1CHBF_en-GBTH1186TH1186&oq=instructions+for+synology+dsm+7.4+kmip&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQIRiPAjIHCAIQIRiPAtIBCDc4ODNqMGo3qAIIsAIB8QXwkKF9IYSoQw&sourceid=chrome&source=chrome.ob&ie=UTF-8|Setting up a KMIP server with DSM 7.4]]

Know How

© 2007-2026 Bernard Condrau - Powered by DokuWiki