diff --git a/server_https.go b/server_https.go
index 8a6d001..98be95f 100644
--- a/server_https.go
+++ b/server_https.go
@@ -7,8 +7,9 @@ import (
 	"net/http"
 
 	"github.com/fangdingjun/go-log"
-	"github.com/fangdingjun/nghttp2-go"
+	//"github.com/fangdingjun/nghttp2-go"
 	"github.com/miekg/dns"
+	"golang.org/x/net/http2"
 )
 
 func (srv *server) handleHTTPSConn(c net.Conn) {
@@ -23,12 +24,11 @@ func (srv *server) handleHTTPSConn(c net.Conn) {
 		log.Errorln("http2 is needed")
 		return
 	}
-	h2conn, err := nghttp2.Server(tlsconn, srv)
-	if err != nil {
-		log.Errorf("create http2 error: %s", err)
-		return
-	}
-	h2conn.Run()
+	_srv := &http2.Server{}
+	_srv.ServeConn(c, &http2.ServeConnOpts{
+		BaseConfig: &http.Server{},
+		Handler:    srv,
+	})
 }
 
 func (srv *server) handleHTTP2Req(w http.ResponseWriter, r *http.Request) {
diff --git a/upstream.go b/upstream.go
index 47b717b..e7c85e6 100644
--- a/upstream.go
+++ b/upstream.go
@@ -10,8 +10,9 @@ import (
 	"time"
 
 	"github.com/fangdingjun/go-log"
-	nghttp2 "github.com/fangdingjun/nghttp2-go"
+	//nghttp2 "github.com/fangdingjun/nghttp2-go"
 	"github.com/miekg/dns"
+	"golang.org/x/net/http2"
 )
 
 var dnsClientTCP *dns.Client
@@ -108,13 +109,13 @@ func initDNSClient(c *conf) {
 		Net:     "https",
 		Timeout: time.Duration(c.UpstreamTimeout) * time.Second,
 		HTTPClient: &http.Client{
-			Transport: &nghttp2.Transport{
-				DialTLS: func(network, addr string, cfg *tls.Config) (*tls.Conn, error) {
+			Transport: &http2.Transport{
+				DialTLS: func(network, addr string, cfg *tls.Config) (net.Conn, error) {
 					log.Debugln("dial to", network, addr)
 					conn, err := tls.DialWithDialer(dialer, network, addr, cfg)
 					return conn, err
 				},
-				TLSConfig: &tls.Config{
+				TLSClientConfig: &tls.Config{
 					InsecureSkipVerify: c.UpstreamInsecure,
 					NextProtos:         []string{"h2"},
 				},