diff --git a/src/Network/Wai/Handler/WarpTLS/UserId.hs b/src/Network/Wai/Handler/WarpTLS/UserId.hs
--- a/src/Network/Wai/Handler/WarpTLS/UserId.hs
+++ b/src/Network/Wai/Handler/WarpTLS/UserId.hs
@@ -1,22 +1,26 @@
 {-# LANGUAGE OverloadedStrings, BangPatterns #-}
 
 module Network.Wai.Handler.WarpTLS.UserId (
-	CertFile, KeyFile, GroupName, UserName, runTlsWithGroupUserName
-) where
+	CertFile, KeyFile, GroupName, UserName,
+	runTlsWithGroupUserName, runTlsWithGroupUserNameClientCert ) where
 
 import Control.Arrow ((***), (&&&))
 import Control.Exception (bracket)
 import Data.Semigroup ((<>))
 import Data.List (unfoldr)
+import Data.Default
 import Data.Streaming.Network (bindPortTCP)
+import Data.X509
 import System.Posix (
 	groupID, getGroupEntryForName, setGroupID,
 	userID, getUserEntryForName, setUserID )
 import Network.Socket (Socket, withSocketsDo, close)
+import Network.TLS
 import Network.Wai (Application)
 import Network.Wai.Handler.Warp (
 	Settings, HostPreference, getPort, getHost )
-import Network.Wai.Handler.WarpTLS (runTLSSocket, tlsSettingsChainMemory)
+import Network.Wai.Handler.WarpTLS (
+	runTLSSocket, tlsSettingsChainMemory, TLSSettings(..))
 
 import qualified Data.ByteString as BS
 
@@ -36,6 +40,23 @@
 		(bindPortTCPWithName (g, u) (getPort set) (getHost set))
 		close
 		(\sock -> runTLSSocket tset set sock app)
+
+type OnClientCertificate = CertificateChain -> IO CertificateUsage
+
+runTlsWithGroupUserNameClientCert :: (CertFile, KeyFile) ->
+	OnClientCertificate ->
+	(GroupName, UserName) -> Settings -> Application -> IO ()
+runTlsWithGroupUserNameClientCert (crt, key) occ (g, u) set app = do
+	(!c, !cs) <- separateChain <$> BS.readFile crt
+	!k <- BS.readFile key
+	let	tset = tlsSettingsChainMemory c cs k
+	withSocketsDo $ bracket
+		(bindPortTCPWithName (g, u) (getPort set) (getHost set))
+		close
+		(\sock -> runTLSSocket tset {
+			tlsWantClientCert = True,
+			tlsServerHooks = def {
+				onClientCertificate = occ } } set sock app)
 
 bindPortTCPWithName ::
 	(GroupName, UserName) -> Int -> HostPreference -> IO Socket
diff --git a/warp-tls-uid.cabal b/warp-tls-uid.cabal
--- a/warp-tls-uid.cabal
+++ b/warp-tls-uid.cabal
@@ -1,11 +1,13 @@
--- This file has been generated from package.yaml by hpack version 0.20.0.
+cabal-version: 1.12
+
+-- This file has been generated from package.yaml by hpack version 0.31.1.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 130d9fcf94612f5792ad24fb978997a0e63ff351cdcf4d9b009ec54595905242
+-- hash: 37ebca0a5310eea58b05e2e57cc62263cd78c9046975f81d248cab81af730286
 
 name:           warp-tls-uid
-version:        0.2.0.5
+version:        0.2.0.6
 synopsis:       set group and user id before running server
 description:    Please see the README on GitHub at <https://github.com/YoshikuniJujo/warp-tls-uid#readme>
 category:       Web
@@ -17,51 +19,55 @@
 license:        BSD3
 license-file:   LICENSE
 build-type:     Simple
-cabal-version:  >= 1.10
-
 extra-source-files:
-    ChangeLog.md
     README.md
+    ChangeLog.md
 
 source-repository head
   type: git
   location: https://github.com/YoshikuniJujo/warp-tls-uid
 
 library
+  exposed-modules:
+      Network.Wai.Handler.WarpTLS.UserId
+  other-modules:
+      Paths_warp_tls_uid
   hs-source-dirs:
       src
   ghc-options: -Wall -fno-warn-tabs
   build-depends:
       base >=4.7 && <5
     , bytestring
+    , data-default
     , network
     , streaming-commons
+    , tls
     , unix
     , wai
     , warp
     , warp-tls
-  exposed-modules:
-      Network.Wai.Handler.WarpTLS.UserId
-  other-modules:
-      Paths_warp_tls_uid
+    , x509
   default-language: Haskell2010
 
 test-suite warp-tls-uid-test
   type: exitcode-stdio-1.0
   main-is: Spec.hs
+  other-modules:
+      Paths_warp_tls_uid
   hs-source-dirs:
       test
   ghc-options: -Wall -fno-warn-tabs -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       base >=4.7 && <5
     , bytestring
+    , data-default
     , network
     , streaming-commons
+    , tls
     , unix
     , wai
     , warp
     , warp-tls
     , warp-tls-uid
-  other-modules:
-      Paths_warp_tls_uid
+    , x509
   default-language: Haskell2010