diff --git a/cmd/web_letsencrypt.go b/cmd/web_letsencrypt.go
index d50d803e1da..a6839997903 100644
--- a/cmd/web_letsencrypt.go
+++ b/cmd/web_letsencrypt.go
@@ -54,6 +54,7 @@ func runLetsEncrypt(listenAddr, domain, directory, email string, m http.Handler)
 	}
 
 	tlsConfig := magic.TLSConfig()
+	tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2")
 
 	if enableHTTPChallenge {
 		go func() {
diff --git a/modules/graceful/server.go b/modules/graceful/server.go
index 704aa8a2b71..6b7d4a1a970 100644
--- a/modules/graceful/server.go
+++ b/modules/graceful/server.go
@@ -106,7 +106,7 @@ func (srv *Server) ListenAndServe(serve ServeFunction) error {
 func (srv *Server) ListenAndServeTLS(certFile, keyFile string, serve ServeFunction) error {
 	config := &tls.Config{}
 	if config.NextProtos == nil {
-		config.NextProtos = []string{"http/1.1"}
+		config.NextProtos = []string{"h2", "http/1.1"}
 	}
 
 	config.Certificates = make([]tls.Certificate, 1)