diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,12 @@
 # ChangeLog
 
+## 3.4.13
+
+* Introduced new smart constructor `tlsSettingsSni` to make it more convenient
+  to dynamically change certificates. Deprecates `tlsSettingsRef` and
+  `tlsSettingsChainRef`.
+  [#1025](https://github.com/yesodweb/wai/pull/1025)
+
 ## 3.4.12
 
 * Rethrowing asynchronous exceptions
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -35,6 +35,9 @@
     tlsSettingsChainRef,
     CertSettings,
 
+    -- ** Dynamically retrieved
+    tlsSettingsSni,
+
     -- * Accessors
     tlsCredentials,
     tlsLogging,
@@ -161,6 +164,22 @@
         { certSettings = CertFromMemory cert chainCerts key
         }
 
+-- | Smart constructor for TLS settings that obtains its credentials during
+-- Server Name Indication. Can be used to return different credentials
+-- depending on the hostname but also to retrieve dynamically updated
+-- credentials from an IORef. Credentials can be loaded from PEM-encoded chain
+-- and key files using 'TLS.credentialLoadX509'.
+--
+-- @since 3.4.13
+tlsSettingsSni :: (Maybe TLS.HostName -> IO TLS.Credentials) -> TLSSettings
+tlsSettingsSni onServerNameIndicationHook =
+  defaultTlsSettings
+    { tlsCredentials = Just (TLS.Credentials [])
+    , tlsServerHooks = (tlsServerHooks defaultTlsSettings)
+      { TLS.onServerNameIndication =  onServerNameIndicationHook
+      }
+    }
+
 -- | A smart constructor for 'TLSSettings', but uses references to in-memory
 -- representations of the certificate and key based on 'defaultTlsSettings'.
 --
@@ -176,6 +195,8 @@
         { certSettings = CertFromRef cert [] key
         }
 
+{-# DEPRECATED tlsSettingsRef "This function was added to allow Warp to serve new certificates without restarting, but it has always behaved the same as 'tlsSettingsMemory'. It will be removed in the next major release. To retain existing behavior, swich to 'tlsSettingsMemory'. To dynamically update credentials, see 'tlsSettingsSni'." #-}
+
 -- | A smart constructor for 'TLSSettings', but uses references to in-memory
 -- representations of the certificate and key based on 'defaultTlsSettings'.
 --
@@ -192,6 +213,8 @@
     defaultTlsSettings
         { certSettings = CertFromRef cert chainCerts key
         }
+
+{-# DEPRECATED tlsSettingsChainRef "This function was added to allow Warp to serve new certificates without restarting, but it has always behaved the same as 'tlsSettingsChainMemory'. It will be removed in the next major release. To retain existing behavior, swich to 'tlsSettingsChainMemory'. To dynamically update credentials, see 'tlsSettingsSni'." #-}
 
 ----------------------------------------------------------------
 
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.4.12
+Version:             3.4.13
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE