diff --git a/acme/acme.go b/acme/acme.go
index a7b6ce4..4e409be 100644
--- a/acme/acme.go
+++ b/acme/acme.go
@@ -207,7 +207,7 @@
 		return nil, "", responseError(res)
 	}
 
-	curl := res.Header.Get("location") // cert permanent URL
+	curl := res.Header.Get("Location") // cert permanent URL
 	if res.ContentLength == 0 {
 		// no cert in the body; poll until we get it
 		cert, err := c.FetchCert(ctx, curl, bundle)
@@ -240,7 +240,7 @@
 		if res.StatusCode > 299 {
 			return nil, responseError(res)
 		}
-		d := retryAfter(res.Header.Get("retry-after"), 3*time.Second)
+		d := retryAfter(res.Header.Get("Retry-After"), 3*time.Second)
 		select {
 		case <-time.After(d):
 			// retry
@@ -444,7 +444,7 @@
 		if err != nil {
 			return nil, err
 		}
-		retry := res.Header.Get("retry-after")
+		retry := res.Header.Get("Retry-After")
 		if res.StatusCode != http.StatusOK && res.StatusCode != http.StatusAccepted {
 			res.Body.Close()
 			if err := sleep(retry, 1); err != nil {
@@ -703,7 +703,7 @@
 				// clear any nonces that we might've stored that might now be
 				// considered bad
 				c.clearNonces()
-				retry := res.Header.Get("retry-after")
+				retry := res.Header.Get("Retry-After")
 				if err := sleep(retry, 1); err != nil {
 					return nil, err
 				}
diff --git a/acme/acme_test.go b/acme/acme_test.go
index 9bd0e74..14832de 100644
--- a/acme/acme_test.go
+++ b/acme/acme_test.go
@@ -74,7 +74,7 @@
 		revoke = "https://example.com/acme/revoke-cert"
 	)
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("content-type", "application/json")
+		w.Header().Set("Content-Type", "application/json")
 		fmt.Fprintf(w, `{
 			"new-reg": %q,
 			"new-authz": %q,
@@ -107,7 +107,7 @@
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -173,7 +173,7 @@
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -234,7 +234,7 @@
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -290,7 +290,7 @@
 func TestAuthorize(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -394,7 +394,7 @@
 func TestAuthorizeValid(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "nonce")
+			w.Header().Set("Replay-Nonce", "nonce")
 			return
 		}
 		w.WriteHeader(http.StatusCreated)
@@ -488,7 +488,7 @@
 	var count int
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		count++
-		w.Header().Set("retry-after", "0")
+		w.Header().Set("Retry-After", "0")
 		if count > 1 {
 			fmt.Fprintf(w, `{"status":"valid"}`)
 			return
@@ -551,7 +551,7 @@
 
 func TestWaitAuthorizationCancel(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("retry-after", "60")
+		w.Header().Set("Retry-After", "60")
 		fmt.Fprintf(w, `{"status":"pending"}`)
 	}))
 	defer ts.Close()
@@ -579,7 +579,7 @@
 func TestRevokeAuthorization(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "nonce")
+			w.Header().Set("Replay-Nonce", "nonce")
 			return
 		}
 		switch r.URL.Path {
@@ -652,7 +652,7 @@
 func TestAcceptChallenge(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -718,7 +718,7 @@
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "test-nonce")
+			w.Header().Set("Replay-Nonce", "test-nonce")
 			return
 		}
 		if r.Method != "POST" {
@@ -801,7 +801,7 @@
 		count++
 		if count < 3 {
 			up := fmt.Sprintf("<%s>;rel=up", ts.URL)
-			w.Header().Set("link", up)
+			w.Header().Set("Link", up)
 		}
 		w.Write([]byte{count})
 	}))
@@ -820,7 +820,7 @@
 	var count int
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if count < 1 {
-			w.Header().Set("retry-after", "0")
+			w.Header().Set("Retry-After", "0")
 			w.WriteHeader(http.StatusAccepted)
 			count++
 			return
@@ -840,7 +840,7 @@
 
 func TestFetchCertCancel(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("retry-after", "0")
+		w.Header().Set("Retry-After", "0")
 		w.WriteHeader(http.StatusAccepted)
 	}))
 	defer ts.Close()
@@ -867,7 +867,7 @@
 			t.Errorf("count = %d; want at most %d", count, maxChainLen+1)
 			w.WriteHeader(http.StatusInternalServerError)
 		}
-		w.Header().Set("link", fmt.Sprintf("<%s>;rel=up", ts.URL))
+		w.Header().Set("Link", fmt.Sprintf("<%s>;rel=up", ts.URL))
 		w.Write([]byte{count})
 	}))
 	defer ts.Close()
@@ -881,7 +881,7 @@
 	var ts *httptest.Server
 	ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		for i := 0; i < maxChainLen+1; i++ {
-			w.Header().Add("link", fmt.Sprintf("<%s>;rel=up", ts.URL))
+			w.Header().Add("Link", fmt.Sprintf("<%s>;rel=up", ts.URL))
 		}
 		w.Write([]byte{1})
 	}))
@@ -907,7 +907,7 @@
 func TestRevokeCert(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == "HEAD" {
-			w.Header().Set("replay-nonce", "nonce")
+			w.Header().Set("Replay-Nonce", "nonce")
 			return
 		}
 
@@ -977,7 +977,7 @@
 		if r.Method != "HEAD" {
 			t.Errorf("%d: r.Method = %q; want HEAD", i, r.Method)
 		}
-		w.Header().Set("replay-nonce", tests[i].nonce)
+		w.Header().Set("Replay-Nonce", tests[i].nonce)
 		w.WriteHeader(tests[i].code)
 	}))
 	defer ts.Close()
@@ -1018,7 +1018,7 @@
 	seen := make(map[string]bool)
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		count++
-		w.Header().Set("replay-nonce", fmt.Sprintf("nonce%d", count))
+		w.Header().Set("Replay-Nonce", fmt.Sprintf("nonce%d", count))
 		if r.Method == "HEAD" {
 			// We expect the client do a HEAD request
 			// but only to fetch the first nonce.
@@ -1072,7 +1072,7 @@
 	var count int
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		count++
-		w.Header().Set("replay-nonce", fmt.Sprintf("nonce%d", count))
+		w.Header().Set("Replay-Nonce", fmt.Sprintf("nonce%d", count))
 		if r.Method == "HEAD" {
 			// We expect the client to do 2 head requests to fetch
 			// nonces, one to start and another after getting badNonce
diff --git a/acme/autocert/autocert_test.go b/acme/autocert/autocert_test.go
index 0352e34..43a6201 100644
--- a/acme/autocert/autocert_test.go
+++ b/acme/autocert/autocert_test.go
@@ -278,7 +278,7 @@
 	// ACME CA server stub
 	var ca *httptest.Server
 	ca = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("replay-nonce", "nonce")
+		w.Header().Set("Replay-Nonce", "nonce")
 		if r.Method == "HEAD" {
 			// a nonce request
 			return
@@ -295,7 +295,7 @@
 			w.Write([]byte("{}"))
 		// domain authorization
 		case "/new-authz":
-			w.Header().Set("location", ca.URL+"/authz/1")
+			w.Header().Set("Location", ca.URL+"/authz/1")
 			w.WriteHeader(http.StatusCreated)
 			if err := authzTmpl.Execute(w, ca.URL); err != nil {
 				t.Errorf("authzTmpl: %v", err)
@@ -326,7 +326,7 @@
 				t.Errorf("new-cert: dummyCert: %v", err)
 			}
 			chainUp := fmt.Sprintf("<%s/ca-cert>; rel=up", ca.URL)
-			w.Header().Set("link", chainUp)
+			w.Header().Set("Link", chainUp)
 			w.WriteHeader(http.StatusCreated)
 			w.Write(der)
 		// CA chain cert
diff --git a/acme/autocert/renewal_test.go b/acme/autocert/renewal_test.go
index f232619..11d40ff 100644
--- a/acme/autocert/renewal_test.go
+++ b/acme/autocert/renewal_test.go
@@ -53,7 +53,7 @@
 	// ACME CA server stub
 	var ca *httptest.Server
 	ca = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("replay-nonce", "nonce")
+		w.Header().Set("Replay-Nonce", "nonce")
 		if r.Method == "HEAD" {
 			// a nonce request
 			return
@@ -70,7 +70,7 @@
 			w.Write([]byte("{}"))
 		// domain authorization
 		case "/new-authz":
-			w.Header().Set("location", ca.URL+"/authz/1")
+			w.Header().Set("Location", ca.URL+"/authz/1")
 			w.WriteHeader(http.StatusCreated)
 			w.Write([]byte(`{"status": "valid"}`))
 		// cert request
@@ -89,7 +89,7 @@
 				t.Fatalf("new-cert: dummyCert: %v", err)
 			}
 			chainUp := fmt.Sprintf("<%s/ca-cert>; rel=up", ca.URL)
-			w.Header().Set("link", chainUp)
+			w.Header().Set("Link", chainUp)
 			w.WriteHeader(http.StatusCreated)
 			w.Write(der)
 		// CA chain cert