diff --git a/common.go b/common.go
index 3e24c82..60f47b4 100644
--- a/common.go
+++ b/common.go
@@ -387,6 +387,14 @@ type Config struct {
 	// The default, none, is correct for the vast majority of applications.
 	Renegotiation RenegotiationSupport
 
+	// KeyLogWriter optionally specifies a destination for TLS master secrets
+	// in NSS key log format that can be used to allow external programs
+	// such as Wireshark to decrypt TLS connections.
+	// See https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format.
+	// Use of KeyLogWriter compromises security and should only be
+	// used for debugging.
+	KeyLogWriter io.Writer
+
 	serverInitOnce sync.Once // guards calling (*Config).serverInit
 
 	// mutex protects sessionTicketKeys
@@ -446,6 +454,7 @@ func (c *Config) clone() *Config {
 		CurvePreferences:            c.CurvePreferences,
 		DynamicRecordSizingDisabled: c.DynamicRecordSizingDisabled,
 		Renegotiation:               c.Renegotiation,
+		KeyLogWriter:                c.KeyLogWriter,
 	}
 }
 
@@ -627,6 +636,16 @@ func (c *Config) BuildNameToCertificate() {
 	}
 }
 
+// writeKeyLog logs client random and master secret if logging enabled
+// by setting KeyLogWriter.
+func (c *Config) writeKeyLog(clientRandom, masterSecret []byte) error {
+	if c.KeyLogWriter == nil {
+		return nil
+	}
+	_, err := fmt.Fprintf(c.KeyLogWriter, "CLIENT_RANDOM %x %x\n", clientRandom, masterSecret)
+	return err
+}
+
 // A Certificate is a chain of one or more certificates, leaf first.
 type Certificate struct {
 	Certificate [][]byte
diff --git a/handshake_client.go b/handshake_client.go
index f789e6f..577e823 100644
--- a/handshake_client.go
+++ b/handshake_client.go
@@ -521,6 +521,10 @@ func (hs *clientHandshakeState) doFullHandshake() error {
 	}
 
 	hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
+	if err := c.config.writeKeyLog(hs.hello.random, hs.masterSecret); err != nil {
+		c.sendAlert(alertInternalError)
+		return errors.New("tls: failed to write to key log:" + err.Error())
+	}
 
 	hs.finishedHash.discardHandshakeBuffer()
 
diff --git a/handshake_client_test.go b/handshake_client_test.go
index f7e0dce..45a4544 100644
--- a/handshake_client_test.go
+++ b/handshake_client_test.go
@@ -727,6 +727,47 @@ func TestLRUClientSessionCache(t *testing.T) {
 	}
 }
 
+func TestHandshakeClientKeyLog(t *testing.T) {
+	config := testConfig.clone()
+	buf := &bytes.Buffer{}
+	config.KeyLogWriter = buf
+
+	// config.Rand is zero reader, so client random is all-0
+	var zeroRandom = strings.Repeat("0", 64)
+
+	test := &clientTest{
+		name:    "KeyLogWriter",
+		command: []string{"openssl", "s_server"},
+		config:  config,
+		validate: func(state ConnectionState) error {
+			var format, clientRandom, masterSecret string
+			if _, err := fmt.Fscanf(buf, "%s %s %s\n", &format, &clientRandom, &masterSecret); err != nil {
+				return fmt.Errorf("failed to parse KeyLogWriter: " + err.Error())
+			}
+			if format != "CLIENT_RANDOM" {
+				return fmt.Errorf("got key log format %q, wanted CLIENT_RANDOM", format)
+			}
+			if clientRandom != zeroRandom {
+				return fmt.Errorf("got key log client random %q, wanted %q", clientRandom, zeroRandom)
+			}
+
+			// Master secret is random from server; check length only
+			if len(masterSecret) != 96 {
+				return fmt.Errorf("got wrong length master secret in key log %v, want 96", len(masterSecret))
+			}
+
+			// buf should contain no more lines
+			var trailingGarbage string
+			if _, err := fmt.Fscanln(buf, &trailingGarbage); err == nil {
+				return fmt.Errorf("expected exactly one key in log, got trailing garbage %q", trailingGarbage)
+			}
+
+			return nil
+		},
+	}
+	runClientTestTLS10(t, test)
+}
+
 func TestHandshakeClientALPNMatch(t *testing.T) {
 	config := testConfig.clone()
 	config.NextProtos = []string{"proto2", "proto1"}
diff --git a/handshake_server.go b/handshake_server.go
index 1aac729..17141ae 100644
--- a/handshake_server.go
+++ b/handshake_server.go
@@ -493,6 +493,10 @@ func (hs *serverHandshakeState) doFullHandshake() error {
 		return err
 	}
 	hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.clientHello.random, hs.hello.random)
+	if err := config.writeKeyLog(hs.clientHello.random, hs.masterSecret); err != nil {
+		c.sendAlert(alertInternalError)
+		return err
+	}
 
 	// If we received a client cert in response to our certificate request message,
 	// the client will send us a certificateVerifyMsg immediately after the
diff --git a/handshake_server_test.go b/handshake_server_test.go
index 82d29d2..a266f67 100644
--- a/handshake_server_test.go
+++ b/handshake_server_test.go
@@ -747,6 +747,43 @@ func TestHandshakeServerECDHEECDSAAES(t *testing.T) {
 	runServerTestTLS12(t, test)
 }
 
+func TestHandshakeServerKeyLog(t *testing.T) {
+	config := testConfig.clone()
+	buf := &bytes.Buffer{}
+	config.KeyLogWriter = buf
+
+	test := &serverTest{
+		name:    "KeyLogWriter",
+		command: []string{"openssl", "s_client"},
+		config:  config,
+		validate: func(state ConnectionState) error {
+			var format, clientRandom, masterSecret string
+			if _, err := fmt.Fscanf(buf, "%s %s %s\n", &format, &clientRandom, &masterSecret); err != nil {
+				return fmt.Errorf("failed to parse KeyLogWriter: " + err.Error())
+			}
+			if format != "CLIENT_RANDOM" {
+				return fmt.Errorf("got key log format %q, wanted CLIENT_RANDOM", format)
+			}
+			// Both clientRandom and masterSecret are unpredictable in server handshake test
+			if len(clientRandom) != 64 {
+				return fmt.Errorf("got wrong length client random in key log %v, wanted 64", len(clientRandom))
+			}
+			if len(masterSecret) != 96 {
+				return fmt.Errorf("got wrong length master secret in key log %v, want 96", len(masterSecret))
+			}
+
+			// buf should contain no more lines
+			var trailingGarbage string
+			if _, err := fmt.Fscanln(buf, &trailingGarbage); err == nil {
+				return fmt.Errorf("expected exactly one key in log, got trailing garbage %q", trailingGarbage)
+			}
+
+			return nil
+		},
+	}
+	runServerTestTLS10(t, test)
+}
+
 func TestHandshakeServerALPN(t *testing.T) {
 	config := testConfig.clone()
 	config.NextProtos = []string{"proto1", "proto2"}
diff --git a/testdata/Client-TLSv10-KeyLogWriter b/testdata/Client-TLSv10-KeyLogWriter
new file mode 100644
index 0000000..b2ce45e
--- /dev/null
+++ b/testdata/Client-TLSv10-KeyLogWriter
@@ -0,0 +1,82 @@
+>>> Flow 1 (client to server)
+00000000  16 03 01 00 8b 01 00 00  87 03 03 00 00 00 00 00  |................|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 28 c0 2f  |.............(./|
+00000030  c0 2b c0 30 c0 2c c0 27  c0 13 c0 23 c0 09 c0 14  |.+.0.,.'...#....|
+00000040  c0 0a 00 9c 00 9d 00 3c  00 2f 00 35 c0 12 00 0a  |.......<./.5....|
+00000050  00 05 c0 11 c0 07 01 00  00 36 00 05 00 05 01 00  |.........6......|
+00000060  00 00 00 00 0a 00 08 00  06 00 17 00 18 00 19 00  |................|
+00000070  0b 00 02 01 00 00 0d 00  0e 00 0c 04 01 04 03 05  |................|
+00000080  01 05 03 02 01 02 03 ff  01 00 01 00 00 12 00 00  |................|
+>>> Flow 2 (server to client)
+00000000  16 03 01 00 51 02 00 00  4d 03 01 57 b8 3b cc ec  |....Q...M..W.;..|
+00000010  06 37 31 e0 76 72 0b 48  40 8f 7a 06 15 1b e2 61  |.71.vr.H@.z....a|
+00000020  6e 80 81 64 2d a8 3b d2  07 76 a3 20 93 ee d8 71  |n..d-.;..v. ...q|
+00000030  17 8e 8c a3 74 fd 9e 82  f9 01 66 71 fe 6b 6f 1c  |....t.....fq.ko.|
+00000040  4f 22 2f 50 18 b7 af 56  63 be 52 62 00 2f 00 00  |O"/P...Vc.Rb./..|
+00000050  05 ff 01 00 01 00 16 03  01 02 59 0b 00 02 55 00  |..........Y...U.|
+00000060  02 52 00 02 4f 30 82 02  4b 30 82 01 b4 a0 03 02  |.R..O0..K0......|
+00000070  01 02 02 09 00 e8 f0 9d  3f e2 5b ea a6 30 0d 06  |........?.[..0..|
+00000080  09 2a 86 48 86 f7 0d 01  01 0b 05 00 30 1f 31 0b  |.*.H........0.1.|
+00000090  30 09 06 03 55 04 0a 13  02 47 6f 31 10 30 0e 06  |0...U....Go1.0..|
+000000a0  03 55 04 03 13 07 47 6f  20 52 6f 6f 74 30 1e 17  |.U....Go Root0..|
+000000b0  0d 31 36 30 31 30 31 30  30 30 30 30 30 5a 17 0d  |.160101000000Z..|
+000000c0  32 35 30 31 30 31 30 30  30 30 30 30 5a 30 1a 31  |250101000000Z0.1|
+000000d0  0b 30 09 06 03 55 04 0a  13 02 47 6f 31 0b 30 09  |.0...U....Go1.0.|
+000000e0  06 03 55 04 03 13 02 47  6f 30 81 9f 30 0d 06 09  |..U....Go0..0...|
+000000f0  2a 86 48 86 f7 0d 01 01  01 05 00 03 81 8d 00 30  |*.H............0|
+00000100  81 89 02 81 81 00 db 46  7d 93 2e 12 27 06 48 bc  |.......F}...'.H.|
+00000110  06 28 21 ab 7e c4 b6 a2  5d fe 1e 52 45 88 7a 36  |.(!.~...]..RE.z6|
+00000120  47 a5 08 0d 92 42 5b c2  81 c0 be 97 79 98 40 fb  |G....B[.....y.@.|
+00000130  4f 6d 14 fd 2b 13 8b c2  a5 2e 67 d8 d4 09 9e d6  |Om..+.....g.....|
+00000140  22 38 b7 4a 0b 74 73 2b  c2 34 f1 d1 93 e5 96 d9  |"8.J.ts+.4......|
+00000150  74 7b f3 58 9f 6c 61 3c  c0 b0 41 d4 d9 2b 2b 24  |t{.X.la<..A..++$|
+00000160  23 77 5b 1c 3b bd 75 5d  ce 20 54 cf a1 63 87 1d  |#w[.;.u]. T..c..|
+00000170  1e 24 c4 f3 1d 1a 50 8b  aa b6 14 43 ed 97 a7 75  |.$....P....C...u|
+00000180  62 f4 14 c8 52 d7 02 03  01 00 01 a3 81 93 30 81  |b...R.........0.|
+00000190  90 30 0e 06 03 55 1d 0f  01 01 ff 04 04 03 02 05  |.0...U..........|
+000001a0  a0 30 1d 06 03 55 1d 25  04 16 30 14 06 08 2b 06  |.0...U.%..0...+.|
+000001b0  01 05 05 07 03 01 06 08  2b 06 01 05 05 07 03 02  |........+.......|
+000001c0  30 0c 06 03 55 1d 13 01  01 ff 04 02 30 00 30 19  |0...U.......0.0.|
+000001d0  06 03 55 1d 0e 04 12 04  10 9f 91 16 1f 43 43 3e  |..U..........CC>|
+000001e0  49 a6 de 6d b6 80 d7 9f  60 30 1b 06 03 55 1d 23  |I..m....`0...U.#|
+000001f0  04 14 30 12 80 10 48 13  49 4d 13 7e 16 31 bb a3  |..0...H.IM.~.1..|
+00000200  01 d5 ac ab 6e 7b 30 19  06 03 55 1d 11 04 12 30  |....n{0...U....0|
+00000210  10 82 0e 65 78 61 6d 70  6c 65 2e 67 6f 6c 61 6e  |...example.golan|
+00000220  67 30 0d 06 09 2a 86 48  86 f7 0d 01 01 0b 05 00  |g0...*.H........|
+00000230  03 81 81 00 9d 30 cc 40  2b 5b 50 a0 61 cb ba e5  |.....0.@+[P.a...|
+00000240  53 58 e1 ed 83 28 a9 58  1a a9 38 a4 95 a1 ac 31  |SX...(.X..8....1|
+00000250  5a 1a 84 66 3d 43 d3 2d  d9 0b f2 97 df d3 20 64  |Z..f=C.-...... d|
+00000260  38 92 24 3a 00 bc cf 9c  7d b7 40 20 01 5f aa d3  |8.$:....}.@ ._..|
+00000270  16 61 09 a2 76 fd 13 c3  cc e1 0c 5c ee b1 87 82  |.a..v......\....|
+00000280  f1 6c 04 ed 73 bb b3 43  77 8d 0c 1c f1 0f a1 d8  |.l..s..Cw.......|
+00000290  40 83 61 c9 4c 72 2b 9d  ae db 46 06 06 4d f4 c1  |@.a.Lr+...F..M..|
+000002a0  b3 3e c0 d1 bd 42 d4 db  fe 3d 13 60 84 5c 21 d3  |.>...B...=.`.\!.|
+000002b0  3b e9 fa e7 16 03 01 00  04 0e 00 00 00           |;............|
+>>> Flow 3 (client to server)
+00000000  16 03 01 00 86 10 00 00  82 00 80 b9 65 8d bf a7  |............e...|
+00000010  c8 4b 79 ce 6f cb 8b 13  1c ac b9 7d 66 5e e9 ba  |.Ky.o......}f^..|
+00000020  1d 71 4e a9 e9 34 ae f6  64 65 90 3b d8 16 52 a2  |.qN..4..de.;..R.|
+00000030  6f f4 cb 8a 13 74 a2 ee  b7 27 69 b4 41 c0 90 68  |o....t...'i.A..h|
+00000040  bc 02 69 e1 c6 48 4f 39  36 30 25 ca 4c 17 ce 83  |..i..HO960%.L...|
+00000050  9e 08 56 e3 05 49 93 9e  2e c4 fb e6 c8 01 f1 0f  |..V..I..........|
+00000060  c5 70 0f 08 83 48 e9 48  ef 6e 50 8b 05 7e e5 84  |.p...H.H.nP..~..|
+00000070  25 fa 55 c7 ae 31 02 27  00 ef 3f 98 86 20 12 89  |%.U..1.'..?.. ..|
+00000080  91 59 28 b4 f7 d7 af d2  69 61 35 14 03 01 00 01  |.Y(.....ia5.....|
+00000090  01 16 03 01 00 30 1d 92  fd 37 c1 b0 b9 f3 cf c4  |.....0...7......|
+000000a0  56 72 cf df 2e 24 3f 87  77 5d fa 10 08 81 e8 af  |Vr...$?.w]......|
+000000b0  f3 f1 67 4c ae 73 0f 0f  fa 16 df 37 1f 8a 96 f2  |..gL.s.....7....|
+000000c0  b5 30 9d ca 5a 56                                 |.0..ZV|
+>>> Flow 4 (server to client)
+00000000  14 03 01 00 01 01 16 03  01 00 30 ad 53 97 4c cb  |..........0.S.L.|
+00000010  0f 87 69 5f d3 26 90 f1  76 a3 68 41 0a 3a 53 06  |..i_.&..v.hA.:S.|
+00000020  1c ae b0 2a 60 fd 2c 67  1a b2 02 f8 96 99 cf bf  |...*`.,g........|
+00000030  05 b0 ef 86 30 04 ea 30  79 5c fc                 |....0..0y\.|
+>>> Flow 5 (client to server)
+00000000  17 03 01 00 20 66 62 1a  6e ed 6d 90 3e 99 a2 1b  |.... fb.n.m.>...|
+00000010  40 cd 8e 32 91 1e 92 00  28 0b 13 32 74 a1 d6 66  |@..2....(..2t..f|
+00000020  88 93 a5 69 22 17 03 01  00 20 a4 4e 90 dd 00 9a  |...i".... .N....|
+00000030  df 03 07 6f ef 26 97 0f  3f 6a 51 c8 89 29 26 95  |...o.&..?jQ..)&.|
+00000040  1b c4 8e 70 e5 ba fc 12  40 8c 15 03 01 00 20 ce  |...p....@..... .|
+00000050  a5 16 1a e2 e6 3a 1f a3  4f fe fe 69 73 c4 dd 07  |.....:..O..is...|
+00000060  65 03 99 20 0f ef 79 eb  43 7f df a8 30 03 e9     |e.. ..y.C...0..|
diff --git a/testdata/Server-TLSv10-KeyLogWriter b/testdata/Server-TLSv10-KeyLogWriter
new file mode 100644
index 0000000..aafee9d
--- /dev/null
+++ b/testdata/Server-TLSv10-KeyLogWriter
@@ -0,0 +1,88 @@
+>>> Flow 1 (client to server)
+00000000  16 03 01 00 5f 01 00 00  5b 03 01 57 b8 3c c5 75  |...._...[..W.<.u|
+00000010  f1 cb 38 e5 78 fd 82 44  ba bf 25 55 88 e9 0a 2a  |..8.x..D..%U...*|
+00000020  b2 69 8a b6 c9 75 20 30  14 82 99 00 00 2e 00 39  |.i...u 0.......9|
+00000030  00 38 00 35 00 16 00 13  00 0a 00 33 00 32 00 2f  |.8.5.......3.2./|
+00000040  00 9a 00 99 00 96 00 05  00 04 00 15 00 12 00 09  |................|
+00000050  00 14 00 11 00 08 00 06  00 03 00 ff 01 00 00 04  |................|
+00000060  00 23 00 00                                       |.#..|
+>>> Flow 2 (server to client)
+00000000  16 03 01 00 35 02 00 00  31 03 01 00 00 00 00 00  |....5...1.......|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 35 00 00  |.............5..|
+00000030  09 00 23 00 00 ff 01 00  01 00 16 03 01 02 59 0b  |..#...........Y.|
+00000040  00 02 55 00 02 52 00 02  4f 30 82 02 4b 30 82 01  |..U..R..O0..K0..|
+00000050  b4 a0 03 02 01 02 02 09  00 e8 f0 9d 3f e2 5b ea  |............?.[.|
+00000060  a6 30 0d 06 09 2a 86 48  86 f7 0d 01 01 0b 05 00  |.0...*.H........|
+00000070  30 1f 31 0b 30 09 06 03  55 04 0a 13 02 47 6f 31  |0.1.0...U....Go1|
+00000080  10 30 0e 06 03 55 04 03  13 07 47 6f 20 52 6f 6f  |.0...U....Go Roo|
+00000090  74 30 1e 17 0d 31 36 30  31 30 31 30 30 30 30 30  |t0...16010100000|
+000000a0  30 5a 17 0d 32 35 30 31  30 31 30 30 30 30 30 30  |0Z..250101000000|
+000000b0  5a 30 1a 31 0b 30 09 06  03 55 04 0a 13 02 47 6f  |Z0.1.0...U....Go|
+000000c0  31 0b 30 09 06 03 55 04  03 13 02 47 6f 30 81 9f  |1.0...U....Go0..|
+000000d0  30 0d 06 09 2a 86 48 86  f7 0d 01 01 01 05 00 03  |0...*.H.........|
+000000e0  81 8d 00 30 81 89 02 81  81 00 db 46 7d 93 2e 12  |...0.......F}...|
+000000f0  27 06 48 bc 06 28 21 ab  7e c4 b6 a2 5d fe 1e 52  |'.H..(!.~...]..R|
+00000100  45 88 7a 36 47 a5 08 0d  92 42 5b c2 81 c0 be 97  |E.z6G....B[.....|
+00000110  79 98 40 fb 4f 6d 14 fd  2b 13 8b c2 a5 2e 67 d8  |y.@.Om..+.....g.|
+00000120  d4 09 9e d6 22 38 b7 4a  0b 74 73 2b c2 34 f1 d1  |...."8.J.ts+.4..|
+00000130  93 e5 96 d9 74 7b f3 58  9f 6c 61 3c c0 b0 41 d4  |....t{.X.la<..A.|
+00000140  d9 2b 2b 24 23 77 5b 1c  3b bd 75 5d ce 20 54 cf  |.++$#w[.;.u]. T.|
+00000150  a1 63 87 1d 1e 24 c4 f3  1d 1a 50 8b aa b6 14 43  |.c...$....P....C|
+00000160  ed 97 a7 75 62 f4 14 c8  52 d7 02 03 01 00 01 a3  |...ub...R.......|
+00000170  81 93 30 81 90 30 0e 06  03 55 1d 0f 01 01 ff 04  |..0..0...U......|
+00000180  04 03 02 05 a0 30 1d 06  03 55 1d 25 04 16 30 14  |.....0...U.%..0.|
+00000190  06 08 2b 06 01 05 05 07  03 01 06 08 2b 06 01 05  |..+.........+...|
+000001a0  05 07 03 02 30 0c 06 03  55 1d 13 01 01 ff 04 02  |....0...U.......|
+000001b0  30 00 30 19 06 03 55 1d  0e 04 12 04 10 9f 91 16  |0.0...U.........|
+000001c0  1f 43 43 3e 49 a6 de 6d  b6 80 d7 9f 60 30 1b 06  |.CC>I..m....`0..|
+000001d0  03 55 1d 23 04 14 30 12  80 10 48 13 49 4d 13 7e  |.U.#..0...H.IM.~|
+000001e0  16 31 bb a3 01 d5 ac ab  6e 7b 30 19 06 03 55 1d  |.1......n{0...U.|
+000001f0  11 04 12 30 10 82 0e 65  78 61 6d 70 6c 65 2e 67  |...0...example.g|
+00000200  6f 6c 61 6e 67 30 0d 06  09 2a 86 48 86 f7 0d 01  |olang0...*.H....|
+00000210  01 0b 05 00 03 81 81 00  9d 30 cc 40 2b 5b 50 a0  |.........0.@+[P.|
+00000220  61 cb ba e5 53 58 e1 ed  83 28 a9 58 1a a9 38 a4  |a...SX...(.X..8.|
+00000230  95 a1 ac 31 5a 1a 84 66  3d 43 d3 2d d9 0b f2 97  |...1Z..f=C.-....|
+00000240  df d3 20 64 38 92 24 3a  00 bc cf 9c 7d b7 40 20  |.. d8.$:....}.@ |
+00000250  01 5f aa d3 16 61 09 a2  76 fd 13 c3 cc e1 0c 5c  |._...a..v......\|
+00000260  ee b1 87 82 f1 6c 04 ed  73 bb b3 43 77 8d 0c 1c  |.....l..s..Cw...|
+00000270  f1 0f a1 d8 40 83 61 c9  4c 72 2b 9d ae db 46 06  |....@.a.Lr+...F.|
+00000280  06 4d f4 c1 b3 3e c0 d1  bd 42 d4 db fe 3d 13 60  |.M...>...B...=.`|
+00000290  84 5c 21 d3 3b e9 fa e7  16 03 01 00 04 0e 00 00  |.\!.;...........|
+000002a0  00                                                |.|
+>>> Flow 3 (client to server)
+00000000  16 03 01 00 86 10 00 00  82 00 80 1a 4d 38 1d 19  |............M8..|
+00000010  9b a3 df 67 f5 f8 7e 0a  93 1d d4 2a 3d e2 c2 64  |...g..~....*=..d|
+00000020  9b bb ec 45 54 e6 2d b1  e0 d7 a2 9a 5a c8 7d fd  |...ET.-.....Z.}.|
+00000030  6e f0 da 44 e8 71 ca ff  1d 4f dd 7b 95 f3 60 49  |n..D.q...O.{..`I|
+00000040  8f 35 45 32 f9 8c fd 3c  65 23 7d a8 e4 e9 09 16  |.5E2...<e#}.....|
+00000050  ce bf 17 b0 6d 50 8e 73  06 54 bf e2 10 13 a5 55  |....mP.s.T.....U|
+00000060  80 86 26 a3 bc ee 36 59  c5 b4 1e b2 11 c0 d7 3d  |..&...6Y.......=|
+00000070  33 89 ec 7f 2a 56 ff c3  f7 ed a7 a1 4e 3f 36 1f  |3...*V......N?6.|
+00000080  1c c2 c2 c3 93 21 a7 67  b2 d2 46 14 03 01 00 01  |.....!.g..F.....|
+00000090  01 16 03 01 00 30 9a cd  cc de 85 fd a5 f8 12 52  |.....0.........R|
+000000a0  02 48 59 b5 2a ec 20 38  c6 ba d9 cc 56 ab 0a 9a  |.HY.*. 8....V...|
+000000b0  42 67 da 0a cb 79 c5 61  c7 a8 77 45 67 31 a6 9a  |Bg...y.a..wEg1..|
+000000c0  15 54 1d ef 92 7a                                 |.T...z|
+>>> Flow 4 (server to client)
+00000000  16 03 01 00 82 04 00 00  7e 00 00 00 00 00 78 50  |........~.....xP|
+00000010  46 ad c1 db a8 38 86 7b  2b bb fd d0 c3 42 3e 00  |F....8.{+....B>.|
+00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 94  |................|
+00000030  6d 2c 85 83 61 d2 8a 86  79 fe 6e fd c9 09 56 98  |m,..a...y.n...V.|
+00000040  1c 42 38 90 81 cd eb ed  37 3e 90 af 03 fe 47 6e  |.B8.....7>....Gn|
+00000050  88 1c 9b a1 4e e6 ea 92  09 35 6a 04 11 96 64 cb  |....N....5j...d.|
+00000060  68 2f 53 6c 7c 33 94 11  0c 0d a4 cc f1 0d 90 d1  |h/Sl|3..........|
+00000070  46 96 89 a4 ae 2e 4f 21  25 c1 b0 55 db 34 25 b6  |F.....O!%..U.4%.|
+00000080  28 82 8f 91 3c 59 cb 14  03 01 00 01 01 16 03 01  |(...<Y..........|
+00000090  00 30 ca 15 85 e6 08 c3  bf 01 22 13 e1 06 d2 1f  |.0........".....|
+000000a0  b8 ad b4 cd 89 82 64 58  7f d5 41 a4 51 3a 0f fd  |......dX..A.Q:..|
+000000b0  c6 69 4c d5 28 cc d3 76  cf 88 4f 4e e1 83 cf c6  |.iL.(..v..ON....|
+000000c0  ea ee 17 03 01 00 20 ba  c9 d8 18 92 e2 e4 ae f0  |...... .........|
+000000d0  84 9a 3d fb a7 af c5 04  02 e8 d8 4b e4 44 7a 1b  |..=........K.Dz.|
+000000e0  95 07 db 9e e7 d6 57 17  03 01 00 30 8e f4 91 eb  |......W....0....|
+000000f0  d0 90 84 6b 50 88 8d 35  83 d0 67 bb 51 9b 6a dd  |...kP..5..g.Q.j.|
+00000100  1f 2a 13 ad c6 bd 61 90  07 df c5 76 e2 ac 15 56  |.*....a....v...V|
+00000110  47 7f 72 f9 6f 70 6b da  2f 37 14 28 15 03 01 00  |G.r.opk./7.(....|
+00000120  20 61 e5 d6 fa 55 ae a5  50 5a fc 67 e5 5a a9 89  | a...U..PZ.g.Z..|
+00000130  9b 8c a4 17 01 1c a6 74  29 97 9c 05 a4 d7 d7 d1  |.......t).......|
+00000140  e0                                                |.|
diff --git a/tls_test.go b/tls_test.go
index fdccfca..9305e3a 100644
--- a/tls_test.go
+++ b/tls_test.go
@@ -494,6 +494,10 @@ func TestClone(t *testing.T) {
 		case "ClientSessionCache":
 			f.Set(reflect.ValueOf(NewLRUClientSessionCache(10)))
 			continue
+		case "KeyLogWriter":
+			f.Set(reflect.ValueOf(io.Writer(os.Stdout)))
+			continue
+
 		}
 
 		q, ok := quick.Value(f.Type(), rnd)