diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,8 @@
+## 3.2.12
+
+* A config field: tlsCredentials and tlsSessionManager.
+  [#805](https://github.com/yesodweb/wai/pull/805)
+
 ## 3.2.11
 
 * Ignoring an exception from shutdown (gracefulClose).
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -24,6 +24,7 @@
     -- * Accessors
     , certFile
     , keyFile
+    , tlsCredentials
     , tlsLogging
     , tlsAllowedVersions
     , tlsCiphers
@@ -31,6 +32,7 @@
     , tlsServerHooks
     , tlsServerDHEParams
     , tlsSessionManagerConfig
+    , tlsSessionManager
     , onInsecure
     , OnInsecure (..)
     -- * Runner
@@ -52,6 +54,7 @@
 import qualified Data.IORef as I
 import Data.Streaming.Network (bindPortTCP, safeRecv)
 import Data.Typeable (Typeable)
+import GHC.IO.Exception (IOErrorType(..))
 import Network.Socket (Socket, close, withSocketsDo, SockAddr, accept)
 #if MIN_VERSION_network(3,1,1)
 import Network.Socket (gracefulClose)
@@ -64,7 +67,7 @@
 import Network.Wai (Application)
 import Network.Wai.Handler.Warp
 import Network.Wai.Handler.Warp.Internal
-import System.IO.Error (isEOFError)
+import System.IO.Error (isEOFError, ioeGetErrorType)
 
 ----------------------------------------------------------------
 
@@ -157,6 +160,16 @@
     -- Default: Nothing
     --
     -- Since 3.2.4
+  , tlsCredentials :: Maybe TLS.Credentials
+    -- ^ Specifying 'TLS.Credentials' directly.  If this value is
+    --   specified, other fields such as 'certFile' are ignored.
+    --
+    --   Since 3.2.12
+  , tlsSessionManager :: Maybe TLS.SessionManager
+    -- ^ Specifying 'TLS.SessionManager' directly. If this value is
+    --   specified, 'tlsSessionManagerConfig' is ignored.
+    --
+    --   Since 3.2.12
   }
 
 -- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).
@@ -180,6 +193,8 @@
   , tlsServerHooks = def
   , tlsServerDHEParams = Nothing
   , tlsSessionManagerConfig = Nothing
+  , tlsCredentials = Nothing
+  , tlsSessionManager = Nothing
   }
 
 -- taken from stunnel example in tls-extra
@@ -259,26 +274,34 @@
 
 ----------------------------------------------------------------
 
+loadCredentials :: TLSSettings -> IO TLS.Credentials
+loadCredentials TLSSettings{ tlsCredentials = Just creds } = return creds
+loadCredentials TLSSettings{..} = case (certMemory, keyMemory) of
+    (Nothing, Nothing) -> do
+        cred <- either error id <$> TLS.credentialLoadX509Chain certFile chainCertFiles keyFile
+        return $ TLS.Credentials [cred]
+    (mcert, mkey) -> do
+        cert <- maybe (S.readFile certFile) return mcert
+        key <- maybe (S.readFile keyFile) return mkey
+        cred <- either error return $ TLS.credentialLoadX509ChainFromMemory cert chainCertsMemory key
+        return $ TLS.Credentials [cred]
+
+getSessionManager :: TLSSettings -> IO TLS.SessionManager
+getSessionManager TLSSettings{ tlsSessionManager = Just mgr } = return mgr
+getSessionManager TLSSettings{..} = case tlsSessionManagerConfig of
+      Nothing     -> return TLS.noSessionManager
+      Just config -> SM.newSessionManager config
+
 -- | Running 'Application' with 'TLSSettings' and 'Settings' using
 --   specified 'Socket'.
 runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()
-runTLSSocket tlsset@TLSSettings{..} set sock app = do
-    credential <- case (certMemory, keyMemory) of
-        (Nothing, Nothing) ->
-            either error id <$>
-            TLS.credentialLoadX509Chain certFile chainCertFiles keyFile
-        (mcert, mkey) -> do
-            cert <- maybe (S.readFile certFile) return mcert
-            key <- maybe (S.readFile keyFile) return mkey
-            either error return $
-              TLS.credentialLoadX509ChainFromMemory cert chainCertsMemory key
-    mgr <- case tlsSessionManagerConfig of
-      Nothing     -> return TLS.noSessionManager
-      Just config -> SM.newSessionManager config
-    runTLSSocket' tlsset set credential mgr sock app
+runTLSSocket tlsset set sock app = do
+    credentials <- loadCredentials tlsset
+    mgr <- getSessionManager tlsset
+    runTLSSocket' tlsset set credentials mgr sock app
 
-runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> TLS.SessionManager -> Socket -> Application -> IO ()
-runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
+runTLSSocket' :: TLSSettings -> Settings -> TLS.Credentials -> TLS.SessionManager -> Socket -> Application -> IO ()
+runTLSSocket' tlsset@TLSSettings{..} set credentials mgr sock app =
     runSettingsConnectionMakerSecure set get app
   where
     get = getter tlsset set sock params
@@ -299,7 +322,7 @@
           (if settingsHTTP2Enabled set then Just alpn else Nothing)
       }
     shared = def {
-        TLS.sharedCredentials    = TLS.Credentials [credential]
+        TLS.sharedCredentials    = credentials
       , TLS.sharedSessionManager = mgr
       }
     supported = def { -- TLS.Supported
@@ -368,8 +391,12 @@
       , TLS.backendSend  = sendAll' s
       , TLS.backendRecv  = recvN
       }
-    sendAll' sock bs = sendAll sock bs `E.catch` \(SomeException _) ->
-        throwIO ConnectionClosedByPeer
+    sendAll' sock bs = E.handleJust
+      (\ e -> if ioeGetErrorType e == ResourceVanished
+        then Just ConnectionClosedByPeer
+        else Nothing)
+      throwIO
+      $ sendAll sock bs
     conn ctx writeBuf ref isH2 = Connection {
         connSendMany         = TLS.sendData ctx . L.fromChunks
       , connSendAll          = sendall
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.2.11
+Version:             3.2.12
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE