Re: enforcing tls1.3 no-sni in unbound, or globally

On Tue, Jul 14, 2026 at 01:51:05PM -0400, [email protected] wrote:

>Looking back at your configuration and at the unbound.conf documentation,
>https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html
>I don't see "tls-version:" as a valid option (maybe an alias for tls-protocols?).
>The valus for tls-protocols: should be quoted, ex:  "TLSv1.3.
>You can also use "unbound-control get_option tls-protocols" to see current setting.
>In any case setting/changing this value requires fully restarting the service
>for the change to take effect.  (for me, I'd just do a "rcctl reload unbound")
>

Yes, you're right I had to correct that. tls-version was a thing I got off
the web I think.

% doas unbound-control get_option tls-protocols
TLSv1.3

so it looks like it's all set WRT unbound.

% doas tshark -r tls-versions-test5.pcap -Y "tcp.port == 853 && tls.handshake.type==1 \
&& tls.handshake.extensions_server_name"

(nothing)

web browsing (lynx) still has SNI though

% doas tshark -r tls-versions-test5.pcap -Y "tcp.port == 443 && tls.handshake.type==1 \
&& tls.handshake.extensions_server_name"
1290  56.042036 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com)
1950  66.882389 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com)

Now it's a question of how to get everything else to be tls1.3 only :D
--