diff --git a/tunnel.go b/tunnel.go
index 3be5c5d..91794a9 100644
--- a/tunnel.go
+++ b/tunnel.go
@@ -123,7 +123,9 @@ func (h *tunneler) Tunnel(ctx context.Context, clientConn *proxy.Conn, network,
 	// used by the remote server
 	clientTLSConfig := h.mitm.configForTLSADomain(tlsaDomain)
 	if alpn {
-		clientTLSConfig.NextProtos = []string{remote.ConnectionState().NegotiatedProtocol}
+		if serverProto := remote.ConnectionState().NegotiatedProtocol; serverProto != "" {
+			clientTLSConfig.NextProtos = []string{serverProto}
+		}
 	}
 
 	clientTLS := tls.Server(clientConn, clientTLSConfig)