diff --git a/transport/internet/ws/hub.go b/transport/internet/ws/hub.go
index a85e320e..0e81edc1 100644
--- a/transport/internet/ws/hub.go
+++ b/transport/internet/ws/hub.go
@@ -83,7 +83,12 @@ func (wsl *WSListener) listenws(address v2net.Address, port v2net.Port) error {
 
 	if effectiveConfig.Pto == "wss" {
 		listenerfunc = func() error {
-			return http.ListenAndServeTLS(address.String()+":"+strconv.Itoa(int(port.Value())), effectiveConfig.Cert, effectiveConfig.PrivKey, nil)
+			var err error
+			wsl.listener, err = getstopableTLSlistener(effectiveConfig.Cert, effectiveConfig.PrivKey, address.String()+":"+strconv.Itoa(int(port.Value())))
+			if err != nil {
+				return err
+			}
+			return http.Serve(wsl.listener, nil)
 		}
 	}
 
diff --git a/transport/internet/ws/stopabletlslistener.go b/transport/internet/ws/stopabletlslistener.go
new file mode 100644
index 00000000..58c54fd2
--- /dev/null
+++ b/transport/internet/ws/stopabletlslistener.go
@@ -0,0 +1,18 @@
+package ws
+
+import "crypto/tls"
+
+func getstopableTLSlistener(cert, key, listenaddr string) (*StoppableListener, error) {
+	cer, err := tls.LoadX509KeyPair(cert, key)
+	if err != nil {
+		return nil, err
+	}
+
+	config := &tls.Config{Certificates: []tls.Certificate{cer}}
+	ln, err := tls.Listen("tcp", listenaddr, config)
+	if err != nil {
+		return nil, err
+	}
+	lns, err := NewStoppableListener(ln)
+	return lns, err
+}