diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 3.2.4.1
+
+* Ignore socket errors while sending `close_notify` [#640](https://github.com/yesodweb/wai/issues/640)
+
 ## 3.2.2
 
 * New settting parameter: tlsServerDHEParams [#556](https://github.com/yesodweb/wai/pull/556)
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -4,7 +4,6 @@
 {-# LANGUAGE RecordWildCards #-}
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE PatternGuards #-}
-{-# LANGUAGE CPP #-}
 
 -- | HTTP over TLS support for Warp via the TLS package.
 --
@@ -43,13 +42,10 @@
     , DH.generateParams
     ) where
 
-#if __GLASGOW_HASKELL__ < 709
-import Control.Applicative ((<$>))
-#endif
 import Control.Applicative ((<|>))
-import Control.Exception (Exception, throwIO, bracket, finally, handle, fromException, try, IOException, onException, SomeException(..))
+import Control.Exception (Exception, throwIO, bracket, finally, handle, fromException, try, IOException, onException, SomeException(..), handleJust)
 import qualified Control.Exception as E
-import Control.Monad (void)
+import Control.Monad (void, guard)
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
 import Data.Default.Class (def)
@@ -297,7 +293,12 @@
 
 getter :: TLS.TLSParams params => TLSSettings -> Socket -> params -> IO (IO (Connection, Transport), SockAddr)
 getter tlsset@TLSSettings{..} sock params = do
+#if WINDOWS
+    (s, sa) <- windowsThreadBlockHack $ accept sock
+#else
     (s, sa) <- accept sock
+#endif
+    setSocketCloseOnExec s
     return (mkConn tlsset s params, sa)
 
 mkConn :: TLS.TLSParams params => TLSSettings -> Socket -> params -> IO (Connection, Transport)
@@ -348,8 +349,16 @@
         sendfile fid offset len hook headers =
             readSendFile writeBuf bufferSize sendall fid offset len hook headers
 
-        close' = void (tryIO $ TLS.bye ctx) `finally`
+        close' = void (tryIO sendBye) `finally`
                  TLS.contextClose ctx
+
+        sendBye =
+          -- It's fine if the connection was closed by the other side before
+          -- receiving close_notify, see RFC 5246 section 7.2.1.
+          handleJust
+            (\e -> guard (e == ConnectionClosedByPeer) >> return e)
+            (const (return ()))
+            (TLS.bye ctx)
 
         -- TLS version of recv with a cache for leftover input data.
         -- The cache is shared with recvBuf.
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.2.4
+Version:             3.2.4.2
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE
@@ -18,7 +18,7 @@
 extra-source-files:  ChangeLog.md README.md
 
 Library
-  Build-Depends:     base                          >= 4        && < 5
+  Build-Depends:     base                          >= 4.8      && < 5
                    , bytestring                    >= 0.9
                    , wai                           >= 3.2      && < 3.3
                    , warp                          >= 3.2.10   && < 3.3
@@ -27,9 +27,12 @@
                    , cryptonite                    >= 0.12
                    , network                       >= 2.2.1
                    , streaming-commons
-                   , tls-session-manager
+                   , tls-session-manager           >= 0.0.0.1
   Exposed-modules:   Network.Wai.Handler.WarpTLS
   ghc-options:       -Wall
+  if os(windows)
+      Cpp-Options:   -DWINDOWS
+
 
 source-repository head
   type:     git