diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog
 
+## 0.3.4
+
+* Add a server option to request client certificates.
+  [#94](https://github.com/kazu-yamamoto/quic/pull/94)
+
 ## 0.3.3
 
 * RST_STREAM now contains a proper final size.
diff --git a/Network/QUIC/Config.hs b/Network/QUIC/Config.hs
--- a/Network/QUIC/Config.hs
+++ b/Network/QUIC/Config.hs
@@ -196,6 +196,8 @@
     -- ^ Server addresses assigned to used network interfaces.
     , scALPN :: Maybe (Version -> [ByteString] -> IO ByteString)
     -- ^ ALPN handler.
+    , scWantClientCert :: Bool
+    -- ^ Request a certificate from clients.
     , scRequireRetry :: Bool
     -- ^ Requiring QUIC retry.
     , scSessionManager :: SessionManager
@@ -228,6 +230,7 @@
         , -- server original
           scAddresses = [("0.0.0.0", 4433), ("::", 4433)]
         , scALPN = Nothing
+        , scWantClientCert = False
         , scRequireRetry = False
         , scSessionManager = noSessionManager
         , scDebugLog = Nothing
diff --git a/Network/QUIC/Server.hs b/Network/QUIC/Server.hs
--- a/Network/QUIC/Server.hs
+++ b/Network/QUIC/Server.hs
@@ -10,6 +10,7 @@
     defaultServerConfig,
     scAddresses,
     scALPN,
+    scWantClientCert,
     scRequireRetry,
     scUse0RTT,
     scMaxDatagramFrameSize,
diff --git a/Network/QUIC/TLS.hs b/Network/QUIC/TLS.hs
--- a/Network/QUIC/TLS.hs
+++ b/Network/QUIC/TLS.hs
@@ -92,7 +92,8 @@
   where
     sparams =
         defaultParamsServer
-            { serverShared = sshared
+            { serverWantClientCert = scWantClientCert
+            , serverShared = sshared
             , serverHooks = hook
             , serverSupported = supported
             , serverDebug = debug
diff --git a/quic.cabal b/quic.cabal
--- a/quic.cabal
+++ b/quic.cabal
@@ -1,6 +1,6 @@
-cabal-version:      >=1.10
+cabal-version:      2.0
 name:               quic
-version:            0.3.3
+version:            0.3.4
 license:            BSD3
 license-file:       LICENSE
 maintainer:         kazu@iij.ad.jp
diff --git a/test/HandshakeSpec.hs b/test/HandshakeSpec.hs
--- a/test/HandshakeSpec.hs
+++ b/test/HandshakeSpec.hs
@@ -36,6 +36,27 @@
             let cc = testClientConfig
                 sc = sc0
             testHandshake cc sc waitS FullHandshake
+        it "can request and accept a client certificate" $ do
+            let TLS.Credentials credentials = scCredentials sc0
+            credential <- case credentials of
+                [] -> expectationFailure "test server has no credentials" >> fail "missing credentials"
+                cred : _ -> pure cred
+            let clientHooks =
+                    (ccTlsHooks testClientConfig)
+                        { TLS.onCertificateRequest = const (pure (Just credential))
+                        }
+                serverHooks =
+                    (scTlsHooks sc0)
+                        { TLS.onClientCertificate = const (pure TLS.CertificateUsageAccept)
+                        , TLS.onUnverifiedClientCert = pure True
+                        }
+                cc = testClientConfig{ccTlsHooks = clientHooks}
+                sc =
+                    sc0
+                        { scWantClientCert = True
+                        , scTlsHooks = serverHooks
+                        }
+            testHandshake cc sc waitS FullHandshake
         it "can handshake in the case of TLS hello retry" $ do
             let cc = testClientConfig
                 sc = sc0{scGroups = [P256], scGroupsTLS13 = [[P256]]}
diff --git a/test/TLSSpec.hs b/test/TLSSpec.hs
--- a/test/TLSSpec.hs
+++ b/test/TLSSpec.hs
@@ -25,6 +25,15 @@
 
 spec :: Spec
 spec = do
+    describe "server configuration" $ do
+        it "does not request client certificates by default" $
+            scWantClientCert defaultServerConfig `shouldBe` False
+
+        it "allows client certificates to be requested" $
+            scWantClientCert
+                defaultServerConfig{scWantClientCert = True}
+                `shouldBe` True
+
     ----------------------------------------------------------------
     -- RFC 9001
     --