Unbound 1.7.3 - no TLS certificate validation for upstream (forward) DNS resolvers

Software SW bugs discussion
, ,
1

Note for unbound users with DoT

The TLS certificate of any upstream (forward) DNS resolvers specified for DoT (DNS over TLS) will not be validated unless the TO repo provides

  1. ca-bundle

and

  1. OpenSSL 1.1.x
2

ca-bundle is available in the TO repo since 3.10.5, requires manual installation and unbound setting however

3

I wouldn’t consider this surprising, really, as the “feature” of validating the other end of TLS is rather new in Unbound (commit from April).