diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc
index 7babe305ce..c5ab65782d 100644
--- a/src/etc/inc/unbound.inc
+++ b/src/etc/inc/unbound.inc
@@ -365,7 +365,11 @@ EOF;
 	}
 
 	// TLS Configuration
-	$tlsconfig = "tls-cert-bundle: \"/etc/ssl/cert.pem\"\n";
+	$cabundle = "{$g['unbound_chroot_path']}/cabundle.pem";
+	copy("/etc/ssl/cert.pem", $cabundle);
+	chown($cabundle, 'unbound');
+	chgrp($cabundle, 'unbound');
+	$tlsconfig = "tls-cert-bundle: \"{$cabundle}\"\n";
 
 	if (isset($unboundcfg['enablessl'])) {
 		$tlscert_path = "{$g['unbound_chroot_path']}/sslcert.crt";
@@ -385,8 +389,12 @@ EOF;
 
 		// Write CA and Server Cert
 		file_put_contents($tlscert_path, $cert_chain);
+		chown($tlscert_path, 'unbound');
+		chgrp($tlscert_path, 'unbound');
 		chmod($tlscert_path, 0644);
 		file_put_contents($tlskey_path, base64_decode($cert['prv']));
+		chown($tlskey_path, 'unbound');
+		chgrp($tlskey_path, 'unbound');
 		chmod($tlskey_path, 0600);
 
 		// Add config for CA and Server Cert