diff --git a/Network/HTTP/Conduit.hs b/Network/HTTP/Conduit.hs
--- a/Network/HTTP/Conduit.hs
+++ b/Network/HTTP/Conduit.hs
@@ -81,6 +81,7 @@
     , def
     , method
     , secure
+    , clientCertificates
     , host
     , port
     , path
diff --git a/Network/HTTP/Conduit/ConnInfo.hs b/Network/HTTP/Conduit/ConnInfo.hs
--- a/Network/HTTP/Conduit/ConnInfo.hs
+++ b/Network/HTTP/Conduit/ConnInfo.hs
@@ -119,16 +119,18 @@
             sClose sock
         }
 
-sslClientConn :: String -> ([X509] -> IO CertificateUsage) -> Handle -> IO ConnInfo
-sslClientConn _desc onCerts h = do
+sslClientConn :: String -> ([X509] -> IO CertificateUsage) -> [(X509, Maybe PrivateKey)] -> Handle -> IO ConnInfo
+sslClientConn _desc onCerts clientCerts h = do
 #if DEBUG
     i <- addSocket _desc
 #endif
-    let tcp = defaultParamsClient
+    let setCParams cparams = cparams { onCertificateRequest = const (return clientCerts) }
+        tcp = updateClientParams setCParams $ defaultParamsClient
             { pConnectVersion = TLS10
             , pAllowedVersions = [ TLS10, TLS11, TLS12 ]
             , pCiphers = ciphersuite_all
             , onCertificatesRecv = onCerts
+            , pCertificates = clientCerts
             }
     gen <- makeSystem
     istate <- contextNewOnHandle h tcp gen
diff --git a/Network/HTTP/Conduit/Manager.hs b/Network/HTTP/Conduit/Manager.hs
--- a/Network/HTTP/Conduit/Manager.hs
+++ b/Network/HTTP/Conduit/Manager.hs
@@ -51,6 +51,7 @@
 import Data.CertificateStore (CertificateStore)
 import System.Certificate.X509 (getSystemCertificateStore)
 
+import Network.TLS (PrivateKey)
 import Network.TLS.Extra (certificateVerifyChain, certificateVerifyDomain)
 
 import Network.HTTP.Conduit.ConnInfo
@@ -284,20 +285,22 @@
 
 getSslConn :: MonadResource m
             => ([X509] -> IO CertificateUsage)
+            -> [(X509, Maybe PrivateKey)]
             -> Manager
             -> String -- ^ host
             -> Int -- ^ port
             -> Maybe SocksConf -- ^ optional socks proxy
             -> m (ConnRelease m, ConnInfo, ManagedConn)
-getSslConn checkCert man host' port' socksProxy' =
+getSslConn checkCert clientCerts man host' port' socksProxy' =
     getManagedConn man (ConnKey (T.pack host') port' True) $
-        (connectionTo host' (PortNumber $ fromIntegral port') socksProxy' >>= sslClientConn desc checkCert)
+        (connectionTo host' (PortNumber $ fromIntegral port') socksProxy' >>= sslClientConn desc checkCert clientCerts)
   where
     desc = socketDesc host' port' "secured"
 
 getSslProxyConn
             :: MonadResource m
             => ([X509] -> IO CertificateUsage)
+            -> [(X509, Maybe PrivateKey)]
             -> S8.ByteString -- ^ Target host
             -> Int -- ^ Target port
             -> Manager
@@ -305,9 +308,9 @@
             -> Int -- ^ Proxy port
             -> Maybe SocksConf -- ^ optional SOCKS proxy
             -> m (ConnRelease m, ConnInfo, ManagedConn)
-getSslProxyConn checkCert thost tport man phost pport socksProxy' =
+getSslProxyConn checkCert clientCerts thost tport man phost pport socksProxy' =
     getManagedConn man (ConnKey (T.pack phost) pport True) $
-        doConnect >>= sslClientConn desc checkCert
+        doConnect >>= sslClientConn desc checkCert clientCerts
   where
     desc = socketDesc phost pport "secured-proxy"
     doConnect = do
@@ -396,8 +399,8 @@
     go =
         case (secure req, useProxy) of
             (False, _) -> getSocketConn
-            (True, False) -> getSslConn $ checkCerts m h
-            (True, True) -> getSslProxyConn (checkCerts m h) h (port req)
+            (True, False) -> getSslConn (checkCerts m h) (clientCertificates req)
+            (True, True) -> getSslProxyConn (checkCerts m h) (clientCertificates req) h (port req)
 
 checkCerts :: Manager -> S8.ByteString -> [X509] -> IO CertificateUsage
 checkCerts man host' certs = do
diff --git a/Network/HTTP/Conduit/Request.hs b/Network/HTTP/Conduit/Request.hs
--- a/Network/HTTP/Conduit/Request.hs
+++ b/Network/HTTP/Conduit/Request.hs
@@ -47,7 +47,6 @@
 import Network.HTTP.Conduit.Chunk (chunkIt)
 import Network.HTTP.Conduit.Util (readDec, (<>))
 
-
 -- | Convert a URL into a 'Request'.
 --
 -- This defaults some of the values in 'Request', such as setting 'method' to
@@ -136,6 +135,7 @@
         { host = "localhost"
         , port = 80
         , secure = False
+        , clientCertificates = []
         , requestHeaders = []
         , path = "/"
         , queryString = S8.empty
diff --git a/Network/HTTP/Conduit/Types.hs b/Network/HTTP/Conduit/Types.hs
--- a/Network/HTTP/Conduit/Types.hs
+++ b/Network/HTTP/Conduit/Types.hs
@@ -23,6 +23,9 @@
 
 import Control.Exception (Exception, SomeException)
 
+import Data.Certificate.X509 (X509)
+import Network.TLS (PrivateKey)
+
 type ContentType = S.ByteString
 
 -- | All information on how to connect to a host and what should be sent in the
@@ -50,6 +53,8 @@
     -- ^ HTTP request method, eg GET, POST.
     , secure :: Bool
     -- ^ Whether to use HTTPS (ie, SSL).
+    , clientCertificates :: [(X509, Maybe PrivateKey)]
+    -- ^ SSL client certificates
     , host :: S.ByteString
     , port :: Int
     , path :: S.ByteString
diff --git a/http-conduit.cabal b/http-conduit.cabal
--- a/http-conduit.cabal
+++ b/http-conduit.cabal
@@ -1,5 +1,5 @@
 name:            http-conduit
-version:         1.8.0
+version:         1.8.1
 license:         BSD3
 license-file:    LICENSE
 author:          Michael Snoyman <michael@snoyman.com>