diff --git a/unbound.spec b/unbound.spec
index 8a73436..5d44771 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -30,7 +30,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 1%{?extra_version:.%{extra_version}}%{?dist}
+Release: 2%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
 Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@@ -90,6 +90,8 @@ BuildRequires: systemd
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Requires: %{name}-anchor%{?_isa} = %{version}-%{release}
 Recommends: %{name}-utils%{?_isa} = %{version}-%{release}
+# unbound-keygen.service requires it, bug #2116790
+Requires: openssl
 
 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
@@ -469,6 +471,9 @@ popd
 %{_mandir}/man1/unbound-*
 
 %changelog
+* Tue Aug 09 2022 Petr Menšík <pemensik@redhat.com> - 1.16.2-2
+- Require openssl tool for unbound-keygen (#2116790)
+
 * Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 1.16.2-1
 - Update to 0.16.2 (#2105947)