diff --git a/http2/go18.go b/http2/go18.go
index 633202c..73cc238 100644
--- a/http2/go18.go
+++ b/http2/go18.go
@@ -12,7 +12,11 @@
 	"net/http"
 )
 
-func cloneTLSConfig(c *tls.Config) *tls.Config { return c.Clone() }
+func cloneTLSConfig(c *tls.Config) *tls.Config {
+	c2 := c.Clone()
+	c2.GetClientCertificate = c.GetClientCertificate // golang.org/issue/19264
+	return c2
+}
 
 var _ http.Pusher = (*responseWriter)(nil)
 
diff --git a/http2/go18_test.go b/http2/go18_test.go
index 8365505..30e3b03 100644
--- a/http2/go18_test.go
+++ b/http2/go18_test.go
@@ -7,6 +7,7 @@
 package http2
 
 import (
+	"crypto/tls"
 	"net/http"
 	"testing"
 	"time"
@@ -64,3 +65,15 @@
 		}
 	}
 }
+
+func TestCertClone(t *testing.T) {
+	c := &tls.Config{
+		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			panic("shouldn't be called")
+		},
+	}
+	c2 := cloneTLSConfig(c)
+	if c2.GetClientCertificate == nil {
+		t.Error("GetClientCertificate is nil")
+	}
+}