diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,10 @@
+## 3.3.6
+
+* Fixing a bug of thread killed in the case of event source with
+  HTTP/2 (fixing #692 and #785)
+* New APIs: clientCertificate to get client's certificate
+  [#783](https://github.com/yesodweb/wai/pull/783)
+
 ## 3.3.5
 
 * New APIs: setGracefulCloseTimeout1 and setGracefulCloseTimeout2.
@@ -27,7 +34,7 @@
 ## 3.3.0
 
 * Switching from the original implementation to HTTP/2 server library.
-  [#752](https://github.com/yesodweb/wai/pull/752)
+  [#754](https://github.com/yesodweb/wai/pull/754)
 * Breaking change: The type of `http2dataTrailers` is now
   `HTTP2Data -> TrailersMaker`.
 
diff --git a/Network/Wai/Handler/Warp.hs b/Network/Wai/Handler/Warp.hs
--- a/Network/Wai/Handler/Warp.hs
+++ b/Network/Wai/Handler/Warp.hs
@@ -97,6 +97,7 @@
   , pauseTimeout
   , FileInfo(..)
   , getFileInfo
+  , clientCertificate
   , withApplication
   , withApplicationSettings
   , testWithApplication
@@ -122,9 +123,10 @@
   , defaultPushPromise
   ) where
 
-import Control.Exception (SomeException, throwIO)
+import Control.Exception (SomeException, throwIO, throw)
 import Data.Streaming.Network (HostPreference)
 import qualified Data.Vault.Lazy as Vault
+import Data.X509
 import qualified Network.HTTP.Types as H
 import Network.Socket (SockAddr)
 import Network.Wai (Request, Response, vault)
@@ -491,3 +493,9 @@
 -- Since 3.3.5
 getGracefulCloseTimeout2 :: Settings -> Int
 getGracefulCloseTimeout2 = settingsGracefulCloseTimeout2
+
+-- | Getting information of client certificate.
+--
+-- Since 3.3.5
+clientCertificate :: Request -> Maybe CertificateChain
+clientCertificate = join . Vault.lookup getClientCertificateKey . vault
diff --git a/Network/Wai/Handler/Warp/HTTP2.hs b/Network/Wai/Handler/Warp/HTTP2.hs
--- a/Network/Wai/Handler/Warp/HTTP2.hs
+++ b/Network/Wai/Handler/Warp/HTTP2.hs
@@ -24,14 +24,14 @@
 
 ----------------------------------------------------------------
 
-http2 :: Connection -> Transport -> InternalInfo -> SockAddr -> S.Settings -> (BufSize -> IO ByteString) -> Application -> IO ()
-http2 conn transport ii addr settings readN app =
+http2 :: Connection -> Transport -> InternalInfo -> SockAddr -> S.Settings -> (BufSize -> IO ByteString) -> (ByteString -> IO ()) -> Application -> IO ()
+http2 conn transport ii addr settings readN send app =
     H2.run conf http2server
   where
     conf = H2.Config {
         confWriteBuffer       = connWriteBuffer conn
       , confBufferSize        = connBufferSize conn
-      , confSendAll           = connSendAll conn
+      , confSendAll           = send
       , confReadN             = readN
       , confPositionReadMaker = pReadMaker ii
       }
diff --git a/Network/Wai/Handler/Warp/HTTP2/Request.hs b/Network/Wai/Handler/Warp/HTTP2/Request.hs
--- a/Network/Wai/Handler/Warp/HTTP2/Request.hs
+++ b/Network/Wai/Handler/Warp/HTTP2/Request.hs
@@ -22,7 +22,7 @@
 
 import Network.Wai.Handler.Warp.HTTP2.Types
 import Network.Wai.Handler.Warp.Imports
-import Network.Wai.Handler.Warp.Request (getFileInfoKey, pauseTimeoutKey)
+import Network.Wai.Handler.Warp.Request (getFileInfoKey, pauseTimeoutKey, getClientCertificateKey)
 import qualified Network.Wai.Handler.Warp.Settings as S (Settings, settingsNoParsePath)
 import Network.Wai.Handler.Warp.Types
 
@@ -83,6 +83,7 @@
                 $ Vault.insert setHTTP2DataKey (writeIORef ref)
                 $ Vault.insert modifyHTTP2DataKey (modifyIORef' ref)
                 $ Vault.insert pauseTimeoutKey (T.pause th)
+                $ Vault.insert getClientCertificateKey (tlsClientCertificate transport)
                   Vault.empty
 
 getHTTP2DataKey :: Vault.Key (IO (Maybe HTTP2Data))
diff --git a/Network/Wai/Handler/Warp/Request.hs b/Network/Wai/Handler/Warp/Request.hs
--- a/Network/Wai/Handler/Warp/Request.hs
+++ b/Network/Wai/Handler/Warp/Request.hs
@@ -9,6 +9,7 @@
   , headerLines
   , pauseTimeoutKey
   , getFileInfoKey
+  , getClientCertificateKey
   , NoKeepAliveRequest (..)
   ) where
 
@@ -21,6 +22,7 @@
 import qualified Data.IORef as I
 import Data.Typeable (Typeable)
 import qualified Data.Vault.Lazy as Vault
+import Data.X509
 import qualified Network.HTTP.Types as H
 import Network.Socket (SockAddr)
 import Network.Wai
@@ -76,6 +78,7 @@
         rawPath = if settingsNoParsePath settings then unparsedPath else path
         vaultValue = Vault.insert pauseTimeoutKey (Timeout.pause th)
                    $ Vault.insert getFileInfoKey (getFileInfo ii)
+                   $ Vault.insert getClientCertificateKey (tlsClientCertificate transport)
                      Vault.empty
     (rbody, remainingRef, bodyLength) <- bodyAndSource src cl te
     -- body producing function which will produce '100-continue', if needed
@@ -300,3 +303,7 @@
 getFileInfoKey :: Vault.Key (FilePath -> IO FileInfo)
 getFileInfoKey = unsafePerformIO Vault.newKey
 {-# NOINLINE getFileInfoKey #-}
+
+getClientCertificateKey :: Vault.Key (Maybe CertificateChain)
+getClientCertificateKey = unsafePerformIO Vault.newKey
+{-# NOINLINE getClientCertificateKey #-}
diff --git a/Network/Wai/Handler/Warp/Run.hs b/Network/Wai/Handler/Warp/Run.hs
--- a/Network/Wai/Handler/Warp/Run.hs
+++ b/Network/Wai/Handler/Warp/Run.hs
@@ -350,11 +350,19 @@
     istatus <- newIORef False
     if settingsHTTP2Enabled settings && h2 then do
         rawRecvN <- makeReceiveN bs (connRecv conn) (connRecvBuf conn)
+        -- This thread becomes the sender in http2 library.
+        -- In the case of event source, one request comes and one
+        -- worker gets busy. But it is likely that the receiver does
+        -- not receive any data at all while the sender is sending
+        -- output data from the worker. It's not good enough to tickle
+        -- the time handler in the receiver only. So, we should tickle
+        -- the time handler in both the receiver and the sender.
         let recvN = wrappedRecvN th istatus (settingsSlowlorisSize settings) rawRecvN
+            sendBS x = connSendAll conn x >> T.tickle th
         -- fixme: origAddr
         checkTLS
         setConnHTTP2 conn True
-        http2 conn transport ii origAddr settings recvN app
+        http2 conn transport ii origAddr settings recvN sendBS app
       else do
         src <- mkSource (wrappedRecv conn th istatus (settingsSlowlorisSize settings))
         writeIORef istatus True
diff --git a/Network/Wai/Handler/Warp/Types.hs b/Network/Wai/Handler/Warp/Types.hs
--- a/Network/Wai/Handler/Warp/Types.hs
+++ b/Network/Wai/Handler/Warp/Types.hs
@@ -8,6 +8,7 @@
 import qualified Data.ByteString as S
 import Data.IORef (IORef, readIORef, writeIORef, newIORef)
 import Data.Typeable (Typeable)
+import Data.X509
 import Foreign.Ptr (Ptr)
 import System.Posix.Types (Fd)
 import qualified System.TimeManager as T
@@ -179,6 +180,7 @@
                  , tlsMinorVersion :: Int
                  , tlsNegotiatedProtocol :: Maybe ByteString -- ^ The result of Application Layer Protocol Negociation in RFC 7301
                  , tlsChiperID :: Word16
+                 , tlsClientCertificate :: Maybe CertificateChain
                  }  -- ^ Encrypted channel: TLS or SSL
 
 isTransportSecure :: Transport -> Bool
diff --git a/warp.cabal b/warp.cabal
--- a/warp.cabal
+++ b/warp.cabal
@@ -1,5 +1,5 @@
 Name:                warp
-Version:             3.3.5
+Version:             3.3.6
 Synopsis:            A fast, light-weight web server for WAI applications.
 License:             MIT
 License-file:        LICENSE
@@ -56,6 +56,7 @@
                    , vault                     >= 0.3
                    , wai                       >= 3.2      && < 3.3
                    , word8
+                   , x509
   if impl(ghc < 8)
       Build-Depends: semigroups
   if flag(network-bytestring)
@@ -211,6 +212,7 @@
                    , vault
                    , wai                       >= 3.2      && < 3.3
                    , word8
+                   , x509
     -- Build-Tool-Depends: hspec-discover:hspec-discover
   if impl(ghc < 8)
       Build-Depends: semigroups
@@ -249,6 +251,7 @@
                   , network
                   , time-manager
                   , unix-compat
+                  , x509
   if impl(ghc < 8)
       Build-Depends: semigroups