<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Let's check binaries. <br>
</p>
<p>Found and check unbound libraries. 1.9.1 should have:</p>
<p>lrwxrwxrwx 1 root root 19 Mar 12 22:54 libunbound.so ->
libunbound.so.8.1.1<br>
lrwxrwxrwx 1 root root 20 Jun 21 2018 libunbound.so.2 ->
libunbound.so.2.5.11<br>
-rwxr-xr-x 1 root root 1090048 Jun 21 2018 libunbound.so.2.5.11<br>
lrwxrwxrwx 1 root root 19 Mar 12 22:54 libunbound.so.8 ->
libunbound.so.8.1.1<br>
-rwxr-xr-x 1 root root 1149416 Mar 12 22:54 libunbound.so.8.1.1<br>
</p>
<p>such versions.<br>
</p>
<div class="moz-cite-prefix">04.04.2019 23:35, rollingonchrome via
Unbound-users пишет:<br>
</div>
<blockquote type="cite"
cite="mid:CAB13GNW_1yZtioPkcJNvZGA6CK7iA3Vkds_b9rvyPYKoFGvX7Q@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi Wouter,<br>
<br>
Thank you for taking a look at my config file.
<div><br>
</div>
<div>Sorry for any confusion. I am running Unbound 1.9.1. That
should support the tls-cert-bundle option, correct?<br>
<br>
I had initially tried my config file with 1.9.2, but at Yuri's
suggestion, I downgraded to the latest stable version, 1.9.1.<br>
<br>
The tls-cert-bundle option did not work with either 1.9.2 or
1.9.1.<br>
<br>
I am running Unbound compiled from source on a Raspberry Pi
(Raspbian Jessie).<br>
<br>
I now think the problem may be in the OpenSSL version on
Raspbian, which only supports TLS 1.2.<br>
<br>
Thank you for your help.<br>
<br>
Best,<br>
<br>
RoC
<div dir="ltr"><b
style="color:rgb(0,0,0);font-family:"Times New
Roman";font-size:medium"><br>
</b></div>
<div dir="ltr"><b
style="color:rgb(0,0,0);font-family:"Times New
Roman";font-size:medium">Wouter Wijngaards</b><span
style="color:rgb(0,0,0);font-family:"Times New
Roman";font-size:medium"> </span><a
href="mailto:unbound-users%40nlnetlabs.nl?Subject=Re%3A%20TLS%20certificate%20question%20about%20Unbound%201.9.2&In-Reply-To=%3Caf5612a5-9698-4e0e-19d7-722013bcb885%40nlnetlabs.nl%3E"
title="TLS certificate question about Unbound 1.9.2"
style="font-family:"Times New
Roman";font-size:medium" moz-do-not-send="true">wouter
at nlnetlabs.nl </a><br
style="color:rgb(0,0,0);font-family:"Times New
Roman";font-size:medium">
<i style="color:rgb(0,0,0);font-family:"Times New
Roman";font-size:medium">Thu Apr 4 09:04:46 CEST 2019</i>
<pre style="white-space:pre-wrap;color:rgb(0,0,0)">Hi,
So this config file is fine, the tls-cert-bundle should work find with a
version of unbound that supports the options (eg. 1.9.2). Like, for me,
it works. I guess you downgraded and are now using an older version
that does not support the tls-cert-bundle option, so the unknown keyword
error is accurate?
Best regards, Wouter
On 4/3/19 7:52 PM, rollingonchrome via Unbound-users wrote:
><i> Hello,
</i>><i>
</i>><i> Thank you for the replies. I believe I have the tls-cert-bundle
</i>><i> information correctly indented now. But, I am still getting the same
</i>><i> errors as before about unknown keywords and strays.
</i>><i>
</i>><i> It is indented like this:
</i>><i>
</i>><i> server:
</i>><i>
</i>><i> [a few lines omitted]
</i>><i>
</i>><i> #Added for DoT
</i>><i> tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
</i>><i>
</i>><i> Here is a link to my actual conf file if anyone would be willing to take
</i>><i> a look:
</i>><i> <a href="https://send.firefox.com/download/83192a35d41caf47/#G4NxNtajpM1KmZgLI-boBg" moz-do-not-send="true">https://send.firefox.com/download/83192a35d41caf47/#G4NxNtajpM1KmZgLI-boBg</a>
</i>><i>
</i>><i> I've read that OpenSSL on Jessie doesn't support any TLS except 1.2, so
</i>><i> I'm wondering if that might be this issue. Not sure what version of TLS
</i>><i> Unbound 1.9.1 uses (I downgraded).
</i>><i>
</i>><i> Thank you for your help.
</i>><i>
</i>><i> Best,
</i>><i>
</i>><i> RoC</i></pre>
</div>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
</blockquote>
</div>
</div>
</div>
</blockquote>
<pre class="moz-signature" cols="72">--
"C++ seems like a language suitable for firing other people's legs."
*****************************
* C++20 : Bug to the future *
*****************************</pre>
</body>
</html>