diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 1.3.9
+
+* Support chain certificates in credentials [#82](https://github.com/snoyberg/keter/pull/82)
+
 ## 1.3.7.1
 
 Bug fix: catch exceptions during reload [#64](https://github.com/snoyberg/keter/issues/64)
diff --git a/Keter/Proxy.hs b/Keter/Proxy.hs
--- a/Keter/Proxy.hs
+++ b/Keter/Proxy.hs
@@ -53,8 +53,11 @@
     (run, isSecure) =
         case listener of
             LPInsecure host port -> (Warp.runSettings (warp host port), False)
-            LPSecure host port cert key -> (WarpTLS.runTLS
-                (WarpTLS.tlsSettings (F.encodeString cert) (F.encodeString key))
+            LPSecure host port cert chainCerts key -> (WarpTLS.runTLS
+                (WarpTLS.tlsSettingsChain
+                    (F.encodeString cert)
+                    (map F.encodeString $ V.toList chainCerts)
+                    (F.encodeString key))
                 (warp host port), True)
 
 withClient :: Bool -- ^ is secure?
diff --git a/Keter/Types/V10.hs b/Keter/Types/V10.hs
--- a/Keter/Types/V10.hs
+++ b/Keter/Types/V10.hs
@@ -66,7 +66,8 @@
         , "plugins" .= bconfigPlugins
         ]
 
-data ListeningPort = LPSecure !HostPreference !Port !F.FilePath !F.FilePath
+data ListeningPort = LPSecure !HostPreference !Port
+                              !F.FilePath !(V.Vector F.FilePath) !F.FilePath
                    | LPInsecure !HostPreference !Port
 
 instance ParseYamlFile ListeningPort where
@@ -80,7 +81,9 @@
                 return $ LPInsecure host port
             (Just cert, Just key) -> do
                 port <- o .:? "port" .!= 443
-                return $ LPSecure host port cert key
+                chainCerts <- o .:? "chain-certificates"
+                    >>= maybe (return V.empty) (parseYamlFile basedir)
+                return $ LPSecure host port cert chainCerts key
             _ -> fail "Must provide both certificate and key files"
 
 data KeterConfig = KeterConfig
@@ -117,6 +120,7 @@
             (Warp.getHost s)
             (Warp.getPort s)
             (F.decodeString $ WarpTLS.certFile ts)
+            V.empty
             (F.decodeString $ WarpTLS.keyFile ts)
 
 instance Default KeterConfig where
diff --git a/keter.cabal b/keter.cabal
--- a/keter.cabal
+++ b/keter.cabal
@@ -1,5 +1,5 @@
 Name:                keter
-Version:             1.3.8
+Version:             1.3.9
 Synopsis:            Web application deployment manager, focusing on Haskell web frameworks
 Description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <http://www.stackage.org/package/keter>.
 Homepage:            http://www.yesodweb.com/
@@ -54,7 +54,7 @@
                      , array
                      , mtl
                      , warp
-                     , warp-tls
+                     , warp-tls                  >= 3.0.3
                      , aeson
                      , unordered-containers
                      , vector