Unbound SSL handshake failed on every pfBlockerNG DNSBL reload - SG-1100

Roxy7

Hi all,

Every time pfBlockerNG runs a DNSBL reload (daily CRON or manual Force Reload), Unbound fails to restart with this error:
Starting Unbound Resolver... Not completed. error: SSL handshake failed

My setup:
∙ Netgate SG-1100 (arm64, purchased November 2025)
∙ pfSense Plus 26.03-RELEASE
∙ pfBlockerNG with DNSBL enabled (Unbound mode)
∙ Resolver Live Sync enabled

The only workaround that gets Unbound running again:
rm /var/unbound/pfb_dnsbl*.conf && unbound-anchor -a /var/unbound/root.key && pfSsh.php playback svc restart unbound

This works temporarily but the next DNSBL reload breaks it again. Has anyone solved this permanently?
Thanks

RianKellyIT

The "SSL handshake failed" during Unbound restart is about the control channel certificates that unbound-control uses to communicate with the Unbound daemon, not about DNS-over-TLS. When pfBlockerNG triggers a DNSBL reload, it restarts Unbound, and if the control certificates are expired or corrupted, the restart fails at the handshake step.

Check the certificate dates first:

openssl x509 -in /var/unbound/unbound_control.pem -noout -dates
openssl x509 -in /var/unbound/unbound_server.pem -noout -dates

If either shows "notAfter" in the past, that is the problem. Regenerate them:

unbound-control-setup -d /var/unbound/

Then restart Unbound. The control certs are self-signed and generated during initial setup, but they can expire after a year or two depending on the pfSense version that created them.

The fact that rm /var/unbound/pfb_dnsbl*.conf followed by unbound-anchor fixes it temporarily suggests there may also be a malformed DNSBL include file that Unbound chokes on during parsing. Before the next DNSBL reload, check the generated files:

ls -la /var/unbound/pfb_dnsbl*.conf
unbound-checkconf /var/unbound/unbound.conf

If unbound-checkconf reports errors in any pfb_dnsbl file, that is a pfBlockerNG bug generating invalid Unbound config. On the SG-1100 with limited RAM, large DNSBL lists can also cause Unbound to run out of memory during the reload, which manifests as a generic startup failure.

Roxy7

Super helpful! RAM was the issue but got it sorted due to your help.

Thanks so much!

Gertjan

@Roxy7 said in Unbound SSL handshake failed on every pfBlockerNG DNSBL reload - SG-1100:

pfBlockerNG with DNSBL enabled (Unbound mode)

What is your reason to continue using "Unbound mode" ?
After reading :

and knowing that Python mode uses less memory, restarts unbound way faster, and that you use a 1100, why still "Unbound mode" ?

stephenw10

Yes, you almost always want to use Python mode with DNS-BL and Unbound. Especially if you have DHCP registering in Unbound which restarts it often.