diff --git a/README.md b/README.md
index cc5b00e..87c3690 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 [![HitCounts](http://hits.dwyl.io/p4gefau1t/trojan-go.svg)](http://hits.dwyl.io/p4gefau1t/trojan-go)
 [![Release](https://img.shields.io/github/v/release/p4gefau1t/trojan-go?include_prereleases)](https://img.shields.io/github/v/release/p4gefau1t/trojan-go?include_prereleases)
 [![Release Date](https://img.shields.io/github/release-date-pre/p4gefau1t/trojan-go)](https://img.shields.io/github/release-date-pre/p4gefau1t/trojan-go)
-[![Docker Image](https://images.microbadger.com/badges/image/p4gefau1t/trojan-go.svg)](https://microbadger.com/images/p4gefau1t/trojan-go)
+[![Docker Image](https://images.microbadger.com/badges/image/p4gefau1t/trojan-go.svg)](https://hub.docker.com/r/p4gefau1t/trojan-go)
 
 [![Commit](https://img.shields.io/github/last-commit/p4gefau1t/trojan-go)](https://img.shields.io/github/last-commit/p4gefau1t/trojan-go)
 [![Commit Activity](https://img.shields.io/github/commit-activity/m/p4gefau1t/trojan-go)](https://img.shields.io/github/commit-activity/m/p4gefau1t/trojan-go)
diff --git a/conf/conf.go b/conf/conf.go
index f9ca049..b730eef 100644
--- a/conf/conf.go
+++ b/conf/conf.go
@@ -3,6 +3,7 @@ package conf
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"io"
 
 	"github.com/p4gefau1t/trojan-go/common"
 	utls "github.com/refraction-networking/utls"
@@ -45,6 +46,7 @@ type TLSConfig struct {
 	Curves               string   `json:"curves"`
 	Fingerprint          string   `json:"fingerprint"`
 	ServePlainText       bool     `json:"serve_plain_text"`
+	KeyLogPath           string   `json:"key_log"`
 
 	ClientHelloID    *utls.ClientHelloID
 	FallbackAddress  *common.Address
@@ -56,6 +58,7 @@ type TLSConfig struct {
 	CipherSuiteTLS13 []uint16
 	SessionTicket    bool
 	CurvePreferences []tls.CurveID
+	KeyLogger        io.Writer
 }
 
 type TCPConfig struct {
diff --git a/conf/parse.go b/conf/parse.go
index 9049040..d5c987f 100644
--- a/conf/parse.go
+++ b/conf/parse.go
@@ -18,7 +18,23 @@ import (
 	"golang.org/x/crypto/pbkdf2"
 )
 
+func setKeyLogger(tlsConfig *TLSConfig) error {
+	if tlsConfig.KeyLogPath != "" {
+		log.Warn("TLS key logging activated. USE OF KEY LOGGING COMPROMISES SECURITY. IT SHOULD ONLY BE USED FOR DEBUGGING.")
+		file, err := os.OpenFile(tlsConfig.KeyLogPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+		if err != nil {
+			return common.NewError("Failed to open key log file").Base(err)
+		}
+		tlsConfig.KeyLogger = file
+	}
+	return nil
+}
+
 func loadCert(tlsConfig *TLSConfig) error {
+	err := setKeyLogger(tlsConfig)
+	if err != nil {
+		return err
+	}
 	if tlsConfig.CertPath == "" {
 		log.Info("Cert of the remote server is unspecified. Using default CA list")
 	} else {
@@ -55,6 +71,10 @@ func loadCert(tlsConfig *TLSConfig) error {
 }
 
 func loadCertAndKey(tlsConfig *TLSConfig) error {
+	err := setKeyLogger(tlsConfig)
+	if err != nil {
+		return err
+	}
 	if tlsConfig.KeyPassword != "" {
 		keyFile, err := ioutil.ReadFile(tlsConfig.KeyPath)
 		if err != nil {
diff --git a/proxy/client/tls.go b/proxy/client/tls.go
index f8475ac..a21aae0 100644
--- a/proxy/client/tls.go
+++ b/proxy/client/tls.go
@@ -326,6 +326,7 @@ func (m *TLSManager) dialTLSWithFakeFingerprint() (*utls.UConn, error) {
 		RootCAs:            m.config.TLS.CertPool,
 		ServerName:         m.config.TLS.SNI,
 		InsecureSkipVerify: !m.config.TLS.Verify,
+		KeyLogWriter:       m.config.TLS.KeyLogger,
 	}
 	if workingFingerprint != "" {
 		spec, err := m.genClientSpec(workingFingerprint)
@@ -414,6 +415,7 @@ func (m *TLSManager) DialToServer() (io.ReadWriteCloser, error) {
 			CurvePreferences:       m.config.TLS.CurvePreferences,
 			NextProtos:             m.config.TLS.ALPN,
 			ClientSessionCache:     m.sessionCache,
+			KeyLogWriter:           m.config.TLS.KeyLogger,
 		}
 		tlsConn := tls.Client(tcpConn, tlsConfig)
 		err = tlsConn.Handshake()