Radarr/Radarr · error · DownloadClientUnavailableException

Unable to connect to Diskstation, certificate validation fai

Error message

Unable to connect to Diskstation, certificate validation failed.

What it means

Thrown by DiskStationProxyBase.ProcessRequest when _httpClient.Execute raises a WebException with Status == TrustFailure during a DiskStation API call. This is a TLS certificate validation failure against the Synology NAS. Wrapped as DownloadClientUnavailableException so Radarr marks the client temporarily unavailable and retries rather than flagging it as misconfigured.

Source

Thrown at src/NzbDrone.Core/Download/Clients/DownloadStation/Proxies/DiskStationProxyBase.cs:91

                                                         DownloadStationSettings settings)
            where T : new()
        {
            var request = requestBuilder.Build();
            HttpResponse response;

            try
            {
                response = _httpClient.Execute(request);
            }
            catch (HttpException ex)
            {
                throw new DownloadClientException("Unable to connect to Diskstation, please check your settings", ex);
            }
            catch (WebException ex)
            {
                if (ex.Status == WebExceptionStatus.TrustFailure)
                {
                    throw new DownloadClientUnavailableException("Unable to connect to Diskstation, certificate validation failed.", ex);
                }

                throw new DownloadClientUnavailableException("Unable to connect to Diskstation, please check your settings", ex);
            }

            _logger.Debug("Trying to {0}", operation);

            if (response.StatusCode == HttpStatusCode.OK)
            {
                var responseContent = Json.Deserialize<DiskStationResponse<T>>(response.Content);

                if (responseContent.Success)
                {
                    return responseContent;
                }
                else
                {
                    var msg = $"Failed to {operation}. Reason: {responseContent.Error.GetMessage(api)}";

View on GitHub (pinned to ca451608dc)

Solutions

Install a proper certificate on DSM (Let's Encrypt via DSM's built-in ACME, or a trusted internal CA) and ensure the Host field matches the cert name.
Add the DSM certificate's CA to the trust store of the machine/container running Radarr and restart it.
Ensure the certificate is not expired and the full chain is served by DSM.
Use the exact FQDN from the certificate in the Radarr Host field.

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate the DSM certificate chain from the Radarr host before relying on TLS:
// using var chain = new X509Chain { ChainPolicy = { RevocationMode = X509RevocationMode.NoCheck } };
// if (!chain.Build(serverCert)) { /* will trigger TrustFailure */ }

Try / catch

try
{
    _diskStationProxy.ProcessRequest(builder, operation, settings);
}
catch (DownloadClientUnavailableException ex) when (ex.Message.Contains("certificate validation"))
{
    _logger.Warn(ex, "DiskStation certificate validation failed for {0}", settings.Host);
    MarkClientOffline(settings);
}
catch (DownloadClientUnavailableException)
{
    ScheduleRetry();
}

Prevention

Install a trusted certificate on DSM (Let's Encrypt via DSM ACME) or trust the self-signed CA in the Radarr host store.
Match the Host field to the certificate's FQDN.
Renew certificates before expiry.
Keep the Radarr host's CA bundle current.

When it happens

Trigger: DSM uses the default self-signed certificate and Radarr's host does not trust it; a custom DSM certificate expired or was replaced; accessing DSM by IP while the cert is issued to the NAS hostname; the signing CA is absent from the trust store.

Common situations: Default DSM self-signed cert; renewed Let's Encrypt cert on DSM but Radarr host still trusts the old one; NAS reached via DDNS hostname not present in the cert SAN; containerized Radarr with an outdated CA bundle.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of Radarr/Radarr@ca451608dc (2026-08-13). Data as JSON: /api/errors/715b22d936aa31d6. Report an issue: GitHub.