diff --git a/deps/ngtcp2/crypto/openssl/openssl.c b/deps/ngtcp2/crypto/openssl/openssl.c
index 490303c073..98c18cccd4 100644
--- a/deps/ngtcp2/crypto/openssl/openssl.c
+++ b/deps/ngtcp2/crypto/openssl/openssl.c
@@ -318,6 +318,10 @@ int ngtcp2_crypto_read_write_crypto_data(ngtcp2_conn *conn, void *tls,
       case SSL_ERROR_WANT_READ:
       case SSL_ERROR_WANT_WRITE:
         return 0;
+      case SSL_ERROR_WANT_CLIENT_HELLO_CB:
+        return NGTCP2_ERR_TLS_WANT_CLIENT_HELLO_CB;
+      case SSL_ERROR_WANT_X509_LOOKUP:
+        return NGTCP2_ERR_TLS_WANT_X509_LOOKUP;
       case SSL_ERROR_SSL:
         return -1;
       default:
diff --git a/deps/ngtcp2/lib/includes/ngtcp2/ngtcp2.h b/deps/ngtcp2/lib/includes/ngtcp2/ngtcp2.h
index d6d66f65ab..aa1dfa146a 100644
--- a/deps/ngtcp2/lib/includes/ngtcp2/ngtcp2.h
+++ b/deps/ngtcp2/lib/includes/ngtcp2/ngtcp2.h
@@ -248,6 +248,8 @@ typedef enum ngtcp2_lib_error {
   NGTCP2_ERR_INTERNAL = -238,
   NGTCP2_ERR_CRYPTO_BUFFER_EXCEEDED = -239,
   NGTCP2_ERR_WRITE_STREAM_MORE = -240,
+  NGTCP2_ERR_TLS_WANT_X509_LOOKUP = -241,
+  NGTCP2_ERR_TLS_WANT_CLIENT_HELLO_CB = -242,
   NGTCP2_ERR_FATAL = -500,
   NGTCP2_ERR_NOMEM = -501,
   NGTCP2_ERR_CALLBACK_FAILURE = -502,