diff --git a/Program/Mighty/Config.hs b/Program/Mighty/Config.hs
--- a/Program/Mighty/Config.hs
+++ b/Program/Mighty/Config.hs
@@ -42,7 +42,8 @@
   , opt_server_name = svrnm
   , opt_routing_file = Nothing
   , opt_tls_port = 443
-  , opt_tls_cert_file = "certificate.pem"
+  , opt_tls_cert_file = "cert.pem"
+  , opt_tls_chain_files = "chain.pem"
   , opt_tls_key_file = "key.pem"
   , opt_service = 0
   , opt_report_file = "/tmp/mighty_report"
@@ -69,6 +70,7 @@
   , opt_routing_file :: !(Maybe FilePath)
   , opt_tls_port :: !Int
   , opt_tls_cert_file :: !FilePath
+  , opt_tls_chain_files :: !FilePath
   , opt_tls_key_file :: !FilePath
   , opt_service :: !Int
   , opt_report_file :: !FilePath
@@ -104,6 +106,7 @@
   , opt_routing_file       = Nothing
   , opt_tls_port           = get "Tls_Port" opt_tls_port
   , opt_tls_cert_file      = get "Tls_Cert_File" opt_tls_cert_file
+  , opt_tls_chain_files    = get "Tls_Chain_Files" opt_tls_chain_files
   , opt_tls_key_file       = get "Tls_Key_File" opt_tls_key_file
   , opt_service            = get "Service" opt_service
   , opt_report_file        = get "ReportFile" opt_report_file
diff --git a/conf/example.conf b/conf/example.conf
--- a/conf/example.conf
+++ b/conf/example.conf
@@ -19,7 +19,9 @@
 Fd_Cache_Duration: 10 # seconds
 # Server_Name: Mighttpd/3.x.y
 Tls_Port: 443
-Tls_Cert_File: certificate.pem # should change this with an absolute path
+Tls_Cert_File: cert.pem # should change this with an absolute path
+# should change this with comma-separated absolute paths
+Tls_Chain_Files: chain.pem
 # Currently, Tls_Key_File must not be encrypted.
-Tls_Key_File: key.pem # should change this with an absolute path
+Tls_Key_File: privkey.pem # should change this with an absolute path
 Service: 0 # 0 is HTTP only, 1 is HTTPS only, 2 is both
diff --git a/mighttpd2.cabal b/mighttpd2.cabal
--- a/mighttpd2.cabal
+++ b/mighttpd2.cabal
@@ -1,5 +1,5 @@
 Name:                   mighttpd2
-Version:                3.3.5
+Version:                3.4.0
 Author:                 Kazu Yamamoto <kazu@iij.ad.jp>
 Maintainer:             Kazu Yamamoto <kazu@iij.ad.jp>
 License:                BSD3
diff --git a/src/Server.hs b/src/Server.hs
--- a/src/Server.hs
+++ b/src/Server.hs
@@ -6,6 +6,8 @@
 import Control.Exception (try)
 import Control.Monad (unless, when)
 import qualified Data.ByteString.Char8 as BS
+import Data.Char (isSpace)
+import Data.List (dropWhile, dropWhileEnd, break)
 import Data.Streaming.Network (bindPortTCP)
 import Network (Socket, sClose)
 import qualified Network.HTTP.Client as H
@@ -126,8 +128,16 @@
     case opt_service _opt of
         0 -> return defaultTlsSettings -- this is dummy
         _ -> do cert <- BS.readFile $ opt_tls_cert_file _opt
+                let strip = dropWhileEnd isSpace . dropWhile isSpace
+                    split "" = []
+                    split s = case break (',' ==) s of
+                      ("",r)  -> split (tail r)
+                      (s',"") -> [s']
+                      (s',r)  -> s' : split (tail r)
+                    chain_files = map strip $ split $ opt_tls_chain_files _opt
+                chains <- mapM BS.readFile chain_files
                 key  <- BS.readFile $ opt_tls_key_file _opt
-                return $ tlsSettingsMemory cert key
+                return $ tlsSettingsChainMemory cert chains key
 #else
     return TLSSettings
 #endif
diff --git a/test/ConfigSpec.hs b/test/ConfigSpec.hs
--- a/test/ConfigSpec.hs
+++ b/test/ConfigSpec.hs
@@ -11,4 +11,4 @@
             res `shouldBe` ans
 
 ans :: Option
-ans = Option {opt_port = 80, opt_host = "*", opt_debug_mode = True, opt_user = "root", opt_group = "root", opt_pid_file = "/var/run/mighty.pid", opt_logging = True, opt_log_file = "/var/log/mighty", opt_log_file_size = 16777216, opt_log_backup_number = 10, opt_index_file = "index.html", opt_index_cgi = "index.cgi", opt_status_file_dir = "/usr/local/share/mighty/status", opt_connection_timeout = 30, opt_fd_cache_duration = 10, opt_server_name = "foo", opt_routing_file = Nothing, opt_tls_port = 443, opt_tls_cert_file = "certificate.pem", opt_tls_key_file = "key.pem", opt_service = 0, opt_report_file = "/tmp/mighty_report", opt_proxy_timeout = 0}
+ans = Option {opt_port = 80, opt_host = "*", opt_debug_mode = True, opt_user = "root", opt_group = "root", opt_pid_file = "/var/run/mighty.pid", opt_logging = True, opt_log_file = "/var/log/mighty", opt_log_file_size = 16777216, opt_log_backup_number = 10, opt_index_file = "index.html", opt_index_cgi = "index.cgi", opt_status_file_dir = "/usr/local/share/mighty/status", opt_connection_timeout = 30, opt_fd_cache_duration = 10, opt_server_name = "foo", opt_routing_file = Nothing, opt_tls_port = 443, opt_tls_cert_file = "cert.pem", opt_tls_chain_files = "chain.pem", opt_tls_key_file = "privkey.pem", opt_service = 0, opt_report_file = "/tmp/mighty_report", opt_proxy_timeout = 0}