diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -270,7 +270,7 @@
     runServeSettingsConnectionMakerSecure set get serve
   where
     get = getter tlsset sock params
-    params = TLS.ServerParams {
+    params = def { -- TLS.ServerParams
         TLS.serverWantClientCert = tlsWantClientCert
       , TLS.serverCACertificates = []
       , TLS.serverDHEParams      = Nothing
@@ -286,7 +286,7 @@
     shared = def {
         TLS.sharedCredentials = TLS.Credentials [credential]
       }
-    supported = TLS.Supported {
+    supported = def { -- TLS.Supported
         TLS.supportedVersions       = tlsAllowedVersions
       , TLS.supportedCiphers        = tlsCiphers
       , TLS.supportedCompressions   = [TLS.nullCompression]
@@ -462,7 +462,12 @@
                 }
         return (conn'', TCP)
     DenyInsecure lbs -> do
-        sendAll s "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n"
+        -- FIXME: what about HTTP/2?
+        -- http://tools.ietf.org/html/rfc2817#section-4.2
+        sendAll s "HTTP/1.1 426 Upgrade Required\
+        \r\nUpgrade: TLS/1.0, HTTP/1.1\
+        \r\nConnection: Upgrade\
+        \r\nContent-Type: text/plain\r\n\r\n"
         mapM_ (sendAll s) $ L.toChunks lbs
         sClose s
         throwIO InsecureConnectionDenied
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.1.4
+Version:             3.1.5
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE
@@ -20,7 +20,7 @@
   Build-Depends:     base                          >= 4        && < 5
                    , bytestring                    >= 0.9
                    , wai                           >= 3.0.4    && < 3.1
-                   , warp                          >= 3.1      && < 3.2
+                   , warp                          >= 3.1.7    && < 3.2
                    , data-default-class            >= 0.0.1
                    , tls                           >= 1.3.2
                    , network                       >= 2.2.1