Re: enforcing tls1.3 no-sni in unbound, or globally

On Mon, Jul 13, 2026 at 07:28:03PM -0400, [email protected] wrote:

>All of the commented lines belong in the "server:" section.
>As you have show here they are in the "forward-zone:" section, thus config errors.
>Either add a "server:" above the commented lines or move the lines.

Thank you for that. I was fixated on the "server:" section pertaining
to local only. The unbound services LAN requests on the usual port then
queries external dns on port 853. Unbound now loads without error.

I still see tls1.2 in Client Hello though like this:

%doas tshark -r tls-versions-test2.pcap -Y "tls" | ug 1.1.1.1 | ug TLSv1.2
2:  1223  19.590482 192.168.1.199 → 1.1.1.1      TLSv1.2 131 Client Hello

I'm thinking I maybe need to rebuild libressl without tls1.2 or sni, or install
libressl-portable with those options negated. What do you think?

--