Pi-hole unbound settings fix for https certificates

Help
1

I posted this bug a while ago regarding a relatively high frequency of https certificates failing with my pi-hole setup:

https://discourse.pi-hole.net/t/pi-hole-interfering-with-https-certificates/80562

I believe I have found the cause of this, which is the settings for unbound in /etc/unbound/unbound.conf.d/dietpi.conf.

This combination of settings:

serve-expired: yes

cache-max-ttl: 86400

Means that stale IPs can be served for 24 hours. For sites hosted on CDNs where IPs are rotated more frequently, this can cause an occasional mismatch between the https certificate and the site IP.

Fix:

serve-expired-ttl: 3600

This should limit how long expired entries are served to a maximum of 1 hour.

Because this issue only pops up once or twice a week, I do not yet know if this has fixed the problem, but it should.

2

OK, but which websites give you these issues then exactly ?!

I have never experienced anything like this so far and I have been using Unbound for many years now...

3

I have not experienced such issues either and I have used unbound with Pi-hole for years now. Perhaps I have never used a site that uses low TTL coupled with renewed/short-life certs. These are my relevant settings:

serve-expired: yes
serve-expired-ttl: 43200

4

It’s just random websites. This has bugged me for years, ever since I installed my dietpi/pi-hole system. It only happens a couple times a month, and it could be on any of my household devices, so it’s been really hard to pin down or debug.

5

Mind they are DietPi settings!

I dont have them on my Pi-OS or Debian systems, following the official setup guide:

$ sudo rgrep 'serve-expired\|cache-max-ttl' /etc/unbound/unbound.conf*
$
6

That explains it then! :slight_smile: