{"record":{"id":"715b22d936aa31d6","repo":"Radarr/Radarr","slug":"unable-to-connect-to-diskstation-certificate-vali","errorCode":null,"errorMessage":"Unable to connect to Diskstation, certificate validation failed.","messagePattern":"Unable to connect to Diskstation, certificate validation failed\\.","errorType":"exception","errorClass":"DownloadClientUnavailableException","httpStatus":null,"severity":"error","filePath":"src/NzbDrone.Core/Download/Clients/DownloadStation/Proxies/DiskStationProxyBase.cs","lineNumber":91,"sourceCode":"                                                         DownloadStationSettings settings)\n            where T : new()\n        {\n            var request = requestBuilder.Build();\n            HttpResponse response;\n\n            try\n            {\n                response = _httpClient.Execute(request);\n            }\n            catch (HttpException ex)\n            {\n                throw new DownloadClientException(\"Unable to connect to Diskstation, please check your settings\", ex);\n            }\n            catch (WebException ex)\n            {\n                if (ex.Status == WebExceptionStatus.TrustFailure)\n                {\n                    throw new DownloadClientUnavailableException(\"Unable to connect to Diskstation, certificate validation failed.\", ex);\n                }\n\n                throw new DownloadClientUnavailableException(\"Unable to connect to Diskstation, please check your settings\", ex);\n            }\n\n            _logger.Debug(\"Trying to {0}\", operation);\n\n            if (response.StatusCode == HttpStatusCode.OK)\n            {\n                var responseContent = Json.Deserialize<DiskStationResponse<T>>(response.Content);\n\n                if (responseContent.Success)\n                {\n                    return responseContent;\n                }\n                else\n                {\n                    var msg = $\"Failed to {operation}. Reason: {responseContent.Error.GetMessage(api)}\";","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/Radarr/Radarr/blob/ca451608dc60c6cec754aba8d96bfa30e9468ed5/src/NzbDrone.Core/Download/Clients/DownloadStation/Proxies/DiskStationProxyBase.cs#L73-L109","documentation":"Thrown by DiskStationProxyBase.ProcessRequest when _httpClient.Execute raises a WebException with Status == TrustFailure during a DiskStation API call. This is a TLS certificate validation failure against the Synology NAS. Wrapped as DownloadClientUnavailableException so Radarr marks the client temporarily unavailable and retries rather than flagging it as misconfigured.","triggerScenarios":"DSM uses the default self-signed certificate and Radarr's host does not trust it; a custom DSM certificate expired or was replaced; accessing DSM by IP while the cert is issued to the NAS hostname; the signing CA is absent from the trust store.","commonSituations":"Default DSM self-signed cert; renewed Let's Encrypt cert on DSM but Radarr host still trusts the old one; NAS reached via DDNS hostname not present in the cert SAN; containerized Radarr with an outdated CA bundle.","solutions":["Install a proper certificate on DSM (Let's Encrypt via DSM's built-in ACME, or a trusted internal CA) and ensure the Host field matches the cert name.","Add the DSM certificate's CA to the trust store of the machine/container running Radarr and restart it.","Ensure the certificate is not expired and the full chain is served by DSM.","Use the exact FQDN from the certificate in the Radarr Host field."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate the DSM certificate chain from the Radarr host before relying on TLS:\n// using var chain = new X509Chain { ChainPolicy = { RevocationMode = X509RevocationMode.NoCheck } };\n// if (!chain.Build(serverCert)) { /* will trigger TrustFailure */ }","typeGuard":null,"tryCatchPattern":"try\n{\n    _diskStationProxy.ProcessRequest(builder, operation, settings);\n}\ncatch (DownloadClientUnavailableException ex) when (ex.Message.Contains(\"certificate validation\"))\n{\n    _logger.Warn(ex, \"DiskStation certificate validation failed for {0}\", settings.Host);\n    MarkClientOffline(settings);\n}\ncatch (DownloadClientUnavailableException)\n{\n    ScheduleRetry();\n}","preventionTips":["Install a trusted certificate on DSM (Let's Encrypt via DSM ACME) or trust the self-signed CA in the Radarr host store.","Match the Host field to the certificate's FQDN.","Renew certificates before expiry.","Keep the Radarr host's CA bundle current."],"tags":["downloadstation","synology","tls","certificate","network","download-client"],"backgroundTag":null,"analyzedSha":"ca451608dc60c6cec754aba8d96bfa30e9468ed5","analyzedAt":"2026-08-13T17:21:54.115Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}