I'm trying to set up DNS-over-TLS (DoT) with unbound resolver. i.e. I'm trying to encrypt the connection between the client and unbound I'm NOT trying to encrypt the unbound resolver → upstream connection, which many guides on the internet are talking about.
I have the following in the config file, as explained in the man page, and also described here:
server: interface: 0.0.0.0@853 tls-port: 853 tls-service-key: "/etc/letsencryp/live/DOMAIN/privkey.pem" tls-service-pem: "/etc/letsencryp/live/DOMAIN/fullchain.pem"
But when I try to restart unbound, I get the following permission denied on the certificate files.
package-helper: /var/lib/unbound/root.key has content package-helper: success: the anchor is ok unbound:  unbound[813:0] error: error for cert file: /etc/letsencryp/live/DOMAIN/fullchain.pem unbound:  unbound[813:0] error: error in SSL_CTX use_certificate_chain_file crypto error:0200100D:system library:fopen:Permission denied unbound:  unbound[813:0] error: and additionally crypto error:20074002:BIO routines:file_ctrl:system lib unbound:  unbound[813:0] error: and additionally crypto error:140DC002:SSL routines:use_certificate_chain_file:system lib unbound:  unbound[813:0] fatal error: could not set up listen SSL_CTX systemd: unbound.service: Main process exited, code=exited, status=1/FAILURE
I have tried moving the files out of this directory, and experimented with setting
unbound as the owner. The only way I could make it work was to place the files directly in the
/etc/unbound/ directory. A symlink in the same location pointing to letsencrypt managed files didn't work either. This is not ideal, as I'd need to regularly copy the certificate files out of letsencrypt directory whenever a certificate renewal occurs and/or unnecessarily restart the DNS resolver.
I have thoroughly checked that a chroot is not configured in config files, or default settings, or compiled in the binary. In fact, it has been explicitly disabled by default in Debian (bug report)
How can unbound be unable to read files, that is right there, with
unbound:unbound as owner:group, and permissions set as readable?
I'm using unbound version 1.9.0-2+deb10u1 on Debian buster (10), if it's of any importance.