diff --git a/Network/HTTP2/TLS/Client.hs b/Network/HTTP2/TLS/Client.hs
--- a/Network/HTTP2/TLS/Client.hs
+++ b/Network/HTTP2/TLS/Client.hs
@@ -54,6 +54,7 @@
 import Data.ByteString (ByteString)
 import qualified Data.ByteString.Char8 as BS.C8
 import Data.Maybe (fromMaybe)
+import Data.X509.CertificateStore (isEmptyCertificateStore)
 import Network.HTTP2.Client (Authority, Client, ClientConfig)
 import qualified Network.HTTP2.Client as H2Client
 import Network.Run.TCP (runTCPClientWithSettings)
@@ -250,7 +251,10 @@
 getClientParams Settings{..} sni port alpn = do
     caStore <-
         if settingsValidateCert
-            then getSystemCertificateStore
+            then
+                if isEmptyCertificateStore settingsCAStore
+                    then getSystemCertificateStore
+                    else return settingsCAStore
             else return mempty
     let shared =
             defaultShared
diff --git a/Network/HTTP2/TLS/Client/Settings.hs b/Network/HTTP2/TLS/Client/Settings.hs
--- a/Network/HTTP2/TLS/Client/Settings.hs
+++ b/Network/HTTP2/TLS/Client/Settings.hs
@@ -38,7 +38,7 @@
     --
     -- Default: 'validateDefault'
     , settingsCAStore :: CertificateStore
-    -- ^ Obsoleted.
+    -- ^ Certificate store used for validation. (TLS and H2)
     --
     -- Default: 'mempty'.
     , settingsServerNameOverride :: Maybe HostName
diff --git a/http2-tls.cabal b/http2-tls.cabal
--- a/http2-tls.cabal
+++ b/http2-tls.cabal
@@ -1,6 +1,6 @@
 cabal-version: >=1.10
 name:          http2-tls
-version:       0.4.8
+version:       0.4.9
 license:       BSD3
 license-file:  LICENSE
 maintainer:    Kazu Yamamoto <kazu@iij.ad.jp>
@@ -38,7 +38,7 @@
     build-depends:
         base >=4.9 && <5,
         bytestring >=0.10,
-        crypton-x509-store >=1.6 && <1.7,
+        crypton-x509-store >=1.6.11 && <1.7.0,
         crypton-x509-system >=1.6 && <1.7,
         crypton-x509-validation >=1.6 && <1.7,
         http2 >=5.3.9 && <5.4,