Re: enforcing tls1.3 no-sni in unbound, or globally

On 2026-07-13 16:50:13, "void" wrote:
> I've been reading the unbound.conf manual and trying with unbound.conf like so:
>
> 	forward-zone:
> 		name: "."                       # use for ALL queries
> 	forward-addr: 9.9.9.9@853               # Quad9 DoT
> 	forward-addr: 149.112.112.112@853       # Quad9 DoT
>
> 	forward-tls-upstream: yes
>
> 	#tls-protocols: TLSv1.3
> 	#tls-use-sni: no
>
> 	#tls-ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305:TLS_AES_128_GCM_SHA256"
> 	#tls-ciphersuites: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305:TLS_AES_128_GCM_SHA256"
> 	#tls-version: "TLSv1.3" 

> The above as commented works, but wireshark shows it's using tls1.2 & 1.3
> Uncommenting any of commented entries above causes unbound to fail to start.

All of the commented lines belong in the "server:" section.
As you have show here they are in the "forward-zone:" section, thus config errors.
Either add a "server:" above the commented lines or move the lines.