diff --git a/src/Network/GemServ.hs b/src/Network/GemServ.hs
index 138e58c..2302572 100644
--- a/src/Network/GemServ.hs
+++ b/src/Network/GemServ.hs
@@ -48,7 +48,7 @@ import qualified Data.ByteString as BS
 import Data.ByteString.Builder (charUtf8, stringUtf8, toLazyByteString)
 import qualified Data.ByteString.Lazy as BSL
 import Data.Char (chr, ord, toLower)
-import Data.IORef (IORef, newIORef, writeIORef)
+import Data.IORef (IORef, newIORef, readIORef, writeIORef)
 import Data.List (find, intercalate)
 import Data.Maybe (fromJust)
 import qualified Data.Text as T
@@ -183,7 +183,8 @@ listenLoop sock params handler = do
   let params' = adjustServerParams certRef params
   try (accept params' sock) >>= \case
     Left (_ :: IOException) -> return ()
-    Right conn              -> void $ forkIO $ runConnection conn handler
+    Right conn              -> void $ forkIO $
+      readIORef certRef >>= runConnection conn handler
   listenLoop sock params handler
 
 adjustServerParams
diff --git a/src/Network/GemServ/Internal.hs b/src/Network/GemServ/Internal.hs
index 138fe23..2753c5d 100644
--- a/src/Network/GemServ/Internal.hs
+++ b/src/Network/GemServ/Internal.hs
@@ -34,6 +34,7 @@ module Network.GemServ.Internal (
   runConnection
 ) where
 
+import Data.X509 (Certificate)
 import System.IO.Streams.TLS (TLSConnection)
 
 import Network.GemServ.Types
@@ -45,6 +46,8 @@ runConnection
   -- ^ The connection
   -> GemHandler
   -- ^ The handler that produces the response
+  -> Maybe Certificate
+  -- ^ The client certificate (if available)
   -> IO ()
 runConnection = undefined