diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 9fca7ef22..755eac9af 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -62,6 +62,9 @@ server:
 	use-caps-for-id: yes
 	aggressive-nsec: yes
 
+	# TLS
+	tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt
+
 	# EDNS Buffer Size (#12240)
 	edns-buffer-size: 1232