diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog for warp
 
+## 3.3.20
+
+* Adding "x509" flag.
+  [#871](https://github.com/yesodweb/wai/pull/871)
+
 ## 3.3.19
 
 * Allowing the eMFILE exception in acceptNewConnection.
diff --git a/Network/Wai/Handler/Warp.hs b/Network/Wai/Handler/Warp.hs
--- a/Network/Wai/Handler/Warp.hs
+++ b/Network/Wai/Handler/Warp.hs
@@ -99,7 +99,9 @@
   , pauseTimeout
   , FileInfo(..)
   , getFileInfo
+#ifdef MIN_VERSION_x509
   , clientCertificate
+#endif
   , withApplication
   , withApplicationSettings
   , testWithApplication
@@ -128,7 +130,9 @@
 import UnliftIO.Exception (SomeException, throwIO)
 import Data.Streaming.Network (HostPreference)
 import qualified Data.Vault.Lazy as Vault
+#ifdef MIN_VERSION_x509
 import Data.X509
+#endif
 import qualified Network.HTTP.Types as H
 import Network.Socket (SockAddr)
 import Network.Wai (Request, Response, vault)
@@ -516,8 +520,10 @@
 getGracefulCloseTimeout2 :: Settings -> Int
 getGracefulCloseTimeout2 = settingsGracefulCloseTimeout2
 
+#ifdef MIN_VERSION_x509
 -- | Getting information of client certificate.
 --
 -- Since 3.3.5
 clientCertificate :: Request -> Maybe CertificateChain
 clientCertificate = join . Vault.lookup getClientCertificateKey . vault
+#endif
diff --git a/Network/Wai/Handler/Warp/HTTP2/Request.hs b/Network/Wai/Handler/Warp/HTTP2/Request.hs
--- a/Network/Wai/Handler/Warp/HTTP2/Request.hs
+++ b/Network/Wai/Handler/Warp/HTTP2/Request.hs
@@ -1,3 +1,4 @@
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE BangPatterns #-}
 
 module Network.Wai.Handler.Warp.HTTP2.Request (
@@ -22,7 +23,10 @@
 
 import Network.Wai.Handler.Warp.HTTP2.Types
 import Network.Wai.Handler.Warp.Imports
-import Network.Wai.Handler.Warp.Request (getFileInfoKey, pauseTimeoutKey, getClientCertificateKey)
+import Network.Wai.Handler.Warp.Request (getFileInfoKey, pauseTimeoutKey)
+#ifdef MIN_VERSION_x509
+import Network.Wai.Handler.Warp.Request (getClientCertificateKey)
+#endif
 import qualified Network.Wai.Handler.Warp.Settings as S (Settings, settingsNoParsePath)
 import Network.Wai.Handler.Warp.Types
 
@@ -86,7 +90,9 @@
                 $ Vault.insert setHTTP2DataKey (writeIORef ref)
                 $ Vault.insert modifyHTTP2DataKey (modifyIORef' ref)
                 $ Vault.insert pauseTimeoutKey (T.pause th)
+#ifdef MIN_VERSION_x509
                 $ Vault.insert getClientCertificateKey (getTransportClientCertificate transport)
+#endif
                   Vault.empty
 
 getHTTP2DataKey :: Vault.Key (IO (Maybe HTTP2Data))
diff --git a/Network/Wai/Handler/Warp/Request.hs b/Network/Wai/Handler/Warp/Request.hs
--- a/Network/Wai/Handler/Warp/Request.hs
+++ b/Network/Wai/Handler/Warp/Request.hs
@@ -9,7 +9,9 @@
   , headerLines
   , pauseTimeoutKey
   , getFileInfoKey
+#ifdef MIN_VERSION_x509
   , getClientCertificateKey
+#endif
   , NoKeepAliveRequest (..)
   ) where
 
@@ -22,7 +24,9 @@
 import qualified Data.IORef as I
 import Data.Typeable (Typeable)
 import qualified Data.Vault.Lazy as Vault
+#ifdef MIN_VERSION_x509
 import Data.X509
+#endif
 import qualified Network.HTTP.Types as H
 import Network.Socket (SockAddr)
 import Network.Wai
@@ -72,7 +76,9 @@
         rawPath = if settingsNoParsePath settings then unparsedPath else path
         vaultValue = Vault.insert pauseTimeoutKey (Timeout.pause th)
                    $ Vault.insert getFileInfoKey (getFileInfo ii)
+#ifdef MIN_VERSION_x509
                    $ Vault.insert getClientCertificateKey (getTransportClientCertificate transport)
+#endif
                      Vault.empty
     (rbody, remainingRef, bodyLength) <- bodyAndSource src cl te
     -- body producing function which will produce '100-continue', if needed
@@ -317,6 +323,8 @@
 getFileInfoKey = unsafePerformIO Vault.newKey
 {-# NOINLINE getFileInfoKey #-}
 
+#ifdef MIN_VERSION_x509
 getClientCertificateKey :: Vault.Key (Maybe CertificateChain)
 getClientCertificateKey = unsafePerformIO Vault.newKey
 {-# NOINLINE getClientCertificateKey #-}
+#endif
diff --git a/Network/Wai/Handler/Warp/Types.hs b/Network/Wai/Handler/Warp/Types.hs
--- a/Network/Wai/Handler/Warp/Types.hs
+++ b/Network/Wai/Handler/Warp/Types.hs
@@ -8,7 +8,9 @@
 import qualified Data.ByteString as S
 import Data.IORef (IORef, readIORef, writeIORef, newIORef)
 import Data.Typeable (Typeable)
+#ifdef MIN_VERSION_x509
 import Data.X509
+#endif
 import Foreign.Ptr (Ptr)
 import System.Posix.Types (Fd)
 import qualified System.TimeManager as T
@@ -180,12 +182,16 @@
                  , tlsMinorVersion :: Int
                  , tlsNegotiatedProtocol :: Maybe ByteString -- ^ The result of Application Layer Protocol Negociation in RFC 7301
                  , tlsChiperID :: Word16
+#ifdef MIN_VERSION_x509
                  , tlsClientCertificate :: Maybe CertificateChain
+#endif
                  }  -- ^ Encrypted channel: TLS or SSL
                | QUIC {
                    quicNegotiatedProtocol :: Maybe ByteString
                  , quicChiperID :: Word16
+#ifdef MIN_VERSION_x509
                  , quicClientCertificate :: Maybe CertificateChain
+#endif
                  }
 
 isTransportSecure :: Transport -> Bool
@@ -196,7 +202,9 @@
 isTransportQUIC QUIC{} = True
 isTransportQUIC _      = False
 
+#ifdef MIN_VERSION_x509
 getTransportClientCertificate :: Transport -> Maybe CertificateChain
 getTransportClientCertificate TCP              = Nothing
 getTransportClientCertificate (TLS _ _ _ _ cc) = cc
 getTransportClientCertificate (QUIC _ _ cc)    = cc
+#endif
diff --git a/warp.cabal b/warp.cabal
--- a/warp.cabal
+++ b/warp.cabal
@@ -1,5 +1,5 @@
 Name:                warp
-Version:             3.3.19
+Version:             3.3.20
 Synopsis:            A fast, light-weight web server for WAI applications.
 License:             MIT
 License-file:        LICENSE
@@ -32,6 +32,10 @@
     Description: print debug output. not suitable for production
     Default:     False
 
+Flag x509
+    Description: Adds a dependency on the x509 library to enable getting TLS client certificates.
+    Default:     True
+
 Library
   Build-Depends:     base                      >= 4.12       && < 5
                    , array
@@ -55,8 +59,9 @@
                    , vault                     >= 0.3
                    , wai                       >= 3.2      && < 3.3
                    , word8
-                   , x509
                    , unliftio
+  if flag(x509)
+      Build-Depends: x509
   if impl(ghc < 8)
       Build-Depends: semigroups
   if flag(network-bytestring)
@@ -213,9 +218,10 @@
                    , vault
                    , wai                       >= 3.2      && < 3.3
                    , word8
-                   , x509
                    , unliftio
     -- Build-Tool-Depends: hspec-discover:hspec-discover
+  if flag(x509)
+      Build-Depends: x509
   if impl(ghc < 8)
       Build-Depends: semigroups
                    , transformers
@@ -253,8 +259,9 @@
                   , network
                   , time-manager
                   , unix-compat
-                  , x509
                   , unliftio
+  if flag(x509)
+      Build-Depends: x509
   if impl(ghc < 8)
       Build-Depends: semigroups