https://synoguide.com/2016/04/14/secure-your-synology-with-https-ssl-certificate-from-lets-encrypt/

1. Create a DNS A record which points to your external IP address.
2. Forward ports 80 and 443 from you router to the internal IP address of your Synology NAS.
3. Enable the Web Station package using the Package Center.
   • You don’t have to enable any options in the settings screen of Web Station.

Control Panel –> Security → Certificate (tab) → Add

• Add a new certificate
• Get a certificate from Let’s Encrypt
• Set as default certificate
• Enter the hostname matching the DNS A record and your valid e-mail address
• Enter any SANs, if you need them…probably not

Once the new certificate has been created, select it and click Configure.

Set all services to use the new LetsEncrypt certificate.

The certificate will auto-renew.