diff --git a/Network/HTTP/Enumerator.hs b/Network/HTTP/Enumerator.hs
--- a/Network/HTTP/Enumerator.hs
+++ b/Network/HTTP/Enumerator.hs
@@ -159,7 +159,7 @@
     return a
 
 withSslConn :: MonadIO m
-            => ([X509] -> IO Bool)
+            => ([X509] -> IO TLS.TLSCertificateUsage)
             -> Manager
             -> String -- ^ host
             -> Int -- ^ port
@@ -191,7 +191,7 @@
 data Request m = Request
     { method :: W.Method -- ^ HTTP request method, eg GET, POST.
     , secure :: Bool -- ^ Whether to use HTTPS (ie, SSL).
-    , checkCerts :: [X509] -> IO Bool -- ^ Check if the server certificate is valid. Only relevant for HTTPS.
+    , checkCerts :: [X509] -> IO TLS.TLSCertificateUsage -- ^ Check if the server certificate is valid. Only relevant for HTTPS.
     , host :: W.Ascii
     , port :: Int
     , path :: W.Ascii -- ^ Everything from the host to the query string.
@@ -440,9 +440,9 @@
         , port = port'
         , secure = sec
         , checkCerts = \x ->
-            if certificateVerifyDomain hostname x
-                then certificateVerifyChain x
-                else return False
+            case certificateVerifyDomain hostname x of
+                TLS.CertificateUsageAccept -> certificateVerifyChain x
+                _                          -> return TLS.CertificateUsageAccept
         , requestHeaders = []
         , path = S8.pack
                     $ if null path''
diff --git a/Network/TLS/Client/Enumerator.hs b/Network/TLS/Client/Enumerator.hs
--- a/Network/TLS/Client/Enumerator.hs
+++ b/Network/TLS/Client/Enumerator.hs
@@ -6,6 +6,8 @@
     , connEnum
     , sslClientConn
     , socketConn
+    , TLSCertificateRejectReason(..)
+    , TLSCertificateUsage(..)
     ) where
 
 import Data.ByteString (ByteString)
@@ -59,7 +61,7 @@
     , connClose = sClose sock
     }
 
-sslClientConn :: ([X509] -> IO Bool) -> Handle -> IO ConnInfo
+sslClientConn :: ([X509] -> IO TLSCertificateUsage) -> Handle -> IO ConnInfo
 sslClientConn onCerts h = do
     let tcp = defaultParams
             { pConnectVersion = TLS10
diff --git a/http-enumerator.cabal b/http-enumerator.cabal
--- a/http-enumerator.cabal
+++ b/http-enumerator.cabal
@@ -1,5 +1,5 @@
 name:            http-enumerator
-version:         0.6.5.3
+version:         0.6.5.4
 license:         BSD3
 license-file:    LICENSE
 author:          Michael Snoyman <michael@snoyman.com>
@@ -25,21 +25,22 @@
                  , transformers          >= 0.2     && < 0.3
                  , failure               >= 0.1     && < 0.2
                  , enumerator            >= 0.4.7   && < 0.5
-                 , attoparsec            >= 0.8.0.2 && < 0.9
-                 , attoparsec-enumerator >= 0.2     && < 0.3
+                 , attoparsec            >= 0.8.0.2 && < 0.10
+                 , attoparsec-enumerator >= 0.2.0.4 && < 0.3
                  , utf8-string           >= 0.3.4   && < 0.4
                  , blaze-builder         >= 0.2.1   && < 0.4
                  , zlib-enum             >= 0.2     && < 0.3
                  , http-types            >= 0.6     && < 0.7
                  , blaze-builder-enumerator >= 0.2  && < 0.3
                  , cprng-aes             >= 0.2     && < 0.3
-                 , tls                   >= 0.6     && < 0.7
-                 , tls-extra             >= 0.2     && < 0.3
+                 , tls                   >= 0.7     && < 0.8
+                 , tls-extra             >= 0.3     && < 0.4
                  , monad-control         >= 0.2     && < 0.3
                  , containers            >= 0.2     && < 0.5
                  , certificate           >= 0.7     && < 0.10
                  , case-insensitive      >= 0.2     && < 0.3
                  , base64-bytestring     >= 0.1     && < 0.2
+                 , asn1-data             >= 0.5.1   && < 0.6
     if flag(network-bytestring)
         build-depends: network               >= 2.2.1   && < 2.2.3
                      , network-bytestring    >= 0.1.3   && < 0.1.4