On Tuesday, July 14, 2026, void <[email protected]> wrote: > On Mon, Jul 13, 2026 at 07:28:03PM -0400, [email protected] wrote: > > All of the commented lines belong in the "server:" section. >> As you have show here they are in the "forward-zone:" section, thus >> config errors. >> Either add a "server:" above the commented lines or move the lines. >> > > Thank you for that. I was fixated on the "server:" section pertaining > to local only. The unbound services LAN requests on the usual port then > queries external dns on port 853. Unbound now loads without error. > > I still see tls1.2 in Client Hello though like this: > > %doas tshark -r tls-versions-test2.pcap -Y "tls" | ug 1.1.1.1 | ug TLSv1.2 > 2: 1223 19.590482 192.168.1.199 ā 1.1.1.1 TLSv1.2 131 Client Hello > > I'm thinking I maybe need to rebuild libressl without tls1.2 or sni, or > install > libressl-portable with those options negated. What do you think? >
You should compare this against the tshark view of a connection you make that you *know* to be TLSv1.3. I suggest that because the version number in a TLSv1.3 client hello is actually ā1.2ā for middlebox compatibility; cf rfc8446 section 4.1.2. Iām not familiar with whether or how tshark displays the *real* version number. Philip Guenther
