diff --git a/mighttpd2.cabal b/mighttpd2.cabal
--- a/mighttpd2.cabal
+++ b/mighttpd2.cabal
@@ -1,5 +1,5 @@
 Name:                   mighttpd2
-Version:                3.2.3
+Version:                3.2.4
 Author:                 Kazu Yamamoto <kazu@iij.ad.jp>
 Maintainer:             Kazu Yamamoto <kazu@iij.ad.jp>
 License:                BSD3
@@ -87,7 +87,7 @@
                       , warp >= 3.0.2
   if flag(tls)
     Build-Depends:      tls
-                      , warp-tls >= 1.4.1
+                      , warp-tls >= 3.0.1
   Other-Modules:        Mighty
                         Server
                         WaiApp
@@ -126,7 +126,7 @@
                       , http-client
   if flag(tls)
     Build-Depends:      tls
-                      , warp-tls >= 1.4.1
+                      , warp-tls >= 3.0.1
 
 Source-Repository head
   Type:                 git
diff --git a/src/Server.hs b/src/Server.hs
--- a/src/Server.hs
+++ b/src/Server.hs
@@ -5,7 +5,7 @@
 import Control.Concurrent (runInUnboundThread)
 import Control.Exception (try)
 import Control.Monad (unless, when)
-import qualified Data.ByteString.Char8 as BS (pack)
+import qualified Data.ByteString.Char8 as BS
 import Data.Streaming.Network (bindPortTCP)
 import Network (Socket, sClose)
 import qualified Network.HTTP.Client as H
@@ -18,16 +18,17 @@
 import System.Posix (exitImmediately, Handler(..), getProcessID, setFileMode)
 import System.Posix.Signals (sigCHLD)
 
+import Program.Mighty
+import WaiApp
+
 #ifdef TLS
 import Control.Concurrent.Async (concurrently)
 import Network.Wai.Handler.WarpTLS
 import Control.Monad (void)
+#else
+data TLSSettings = TLSSettings
 #endif
 
-import Program.Mighty
-
-import WaiApp
-
 ----------------------------------------------------------------
 
 defaultDomain :: Domain
@@ -57,6 +58,13 @@
     svc <- openService opt
     unless debug writePidFile
     rdr <- newRouteDBRef route
+#ifdef TLS
+    cert <- BS.readFile $ opt_tls_cert_file opt
+    key  <- BS.readFile $ opt_tls_key_file opt
+    let tlsSetting = tlsSettingsMemory cert key
+#else
+    let tlsSetting = TLSSettings
+#endif
     setGroupUser (opt_user opt) (opt_group opt)
     logCheck logtype
     (zdater,_) <- clockDateCacher
@@ -68,7 +76,7 @@
     setHandlers opt rpt svc remover rdr
 
     report rpt "Mighty started"
-    runInUnboundThread $ mighty opt rpt svc lgr getInfo mgr rdr
+    runInUnboundThread $ mighty opt rpt svc lgr getInfo mgr rdr tlsSetting
     report rpt "Mighty retired"
     finReporter rpt
     remover
@@ -129,14 +137,16 @@
 
 mighty :: Option -> Reporter -> Service
        -> ApacheLogger -> GetInfo -> ConnPool -> RouteDBRef
+       -> TLSSettings
        -> IO ()
-mighty opt rpt svc lgr getInfo _mgr rdr = reportDo rpt $ case svc of
+mighty opt rpt svc lgr getInfo mgr rdr _tlsSetting
+  = reportDo rpt $ case svc of
     HttpOnly s  -> runSettingsSocket setting s app
 #ifdef TLS
-    HttpsOnly s -> runTLSSocket tlsSetting setting s app
+    HttpsOnly s -> runTLSSocket _tlsSetting setting s app
     HttpAndHttps s1 s2 -> void $ concurrently
         (runSettingsSocket setting s1 app)
-        (runTLSSocket tlsSetting setting s2 app)
+        (runTLSSocket _tlsSetting setting s2 app)
 #else
     _ -> error "never reach"
 #endif
@@ -167,14 +177,8 @@
         indexCgi = "index.cgi"
       }
     revproxyspec = RevProxyAppSpec {
-        revProxyManager = _mgr
-      }
-#ifdef TLS
-    tlsSetting = defaultTlsSettings {
-        certFile = opt_tls_cert_file opt
-      , keyFile  = opt_tls_key_file opt
+        revProxyManager = mgr
       }
-#endif
 
 ----------------------------------------------------------------