diff --git a/unbound.spec b/unbound.spec
index 909acc5..079bbc3 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -30,7 +30,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.16.2
-Release: 1%{?extra_version:.%{extra_version}}%{?dist}
+Release: 2%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
 Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@@ -87,6 +87,8 @@ BuildRequires: automake autoconf libtool
 
 # Needed because /usr/sbin/unbound links unbound libs staticly
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+# unbound-keygen.service requires it, bug #2116790
+Requires: openssl
 
 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
@@ -445,6 +447,9 @@ popd
 %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
 
 %changelog
+* Tue Aug 09 2022 Petr Menšík <pemensik@redhat.com> - 1.16.2-2
+- Require openssl tool for unbound-keygen (#2116802)
+
 * Wed Aug 03 2022 Petr Menšík <pemensik@redhat.com> - 1.16.2-1
 - Update to 1.16.2 (#2087120)