Jonah Husson
--- a/grpcweb/transport/transport.go
+++ b/grpcweb/transport/transport.go
 	writeMu sync.Mutex

 	reqHeader, header, trailer http.Header
+	receiveHeaderErr           error
 }

 func (t *webSocketTransport) Header() (http.Header, error) {
+	// Try to read headers if we haven't already
--- a/grpcweb/transport/transport.go
+++ b/grpcweb/transport/transport.go
-var NewClientStream = func(host, endpoint string) (ClientStreamTransport, error) {
-	// TODO: WebSocket over TLS support.
-	u := url.URL{Scheme: "ws", Host: host, Path: endpoint}
+var NewWSStream = func(host, endpoint string, opts *ConnectOptions) (WebsocketStreamingTransport, error) {
 	h := http.Header{}
 	h.Set("Sec-WebSocket-Protocol", "grpc-websockets")
 	var conn *websocket.Conn
-	conn, _, err := websocket.DefaultDialer.Dial(u.String(), h)
+	dialer := &websocket.DialOptions{}
+	dialer.HTTPClient = http.DefaultClient
+	// Set weebsocket dialer http header
+	dialer.HTTPHeader = h
+	// Set websocket dialer subprotocol
+	dialer.Subprotocols = []string{"grpc-websockets"}
+	scheme := "ws"
+	if opts.WithTLS {
--- a/grpcweb/transport/transport.go
+++ b/grpcweb/transport/transport.go
+	scheme := "ws"
+	if opts.WithTLS {
+		scheme = "wss"
+		tlsConf := &tls.Config{}
+		if opts.TLSCertificate != nil {
+			certPool := x509.NewCertPool()
+			decoded, _ := pem.Decode(opts.TLSCertificate)
+			if decoded == nil {
+				panic("failed to decode cert")
+			}
+			cert, err := x509.ParseCertificate(decoded.Bytes)
+			if err != nil {
+				panic(err)
+			}
+			certPool.AddCert(cert)
+			tlsConf.RootCAs = certPool
--- a/grpcweb/transport/transport.go
+++ b/grpcweb/transport/transport.go
+		if opts.TLSCertificate != nil {
+			certPool := x509.NewCertPool()
+			decoded, _ := pem.Decode(opts.TLSCertificate)
+			if decoded == nil {
+				panic("failed to decode cert")
+			}
+			cert, err := x509.ParseCertificate(decoded.Bytes)
+			if err != nil {
+				panic(err)
+			}
+			certPool.AddCert(cert)
+			tlsConf.RootCAs = certPool
+			tlsConf.ServerName = cert.DNSNames[0]
+		}
+
+		tlsConf.InsecureSkipVerify = opts.TlsInsecureSkipVerify
--- a/grpcweb/transport/websocketUnaryTransport.go 0 → 100644
+++ b/grpcweb/transport/websocketUnaryTransport.go 0 → 100644
+		t.writeMessage(int(websocket.MessageBinary), b.Bytes())
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var b bytes.Buffer
+	b.Write([]byte{0x00})
+	_, err = io.Copy(&b, body)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "failed to read request body")
+	}
+
+	t.writeMessage(int(websocket.MessageBinary), b.Bytes())
+
+	t.CloseSend()
--- a/grpcweb/transport/websocketUnaryTransport.go 0 → 100644
+++ b/grpcweb/transport/websocketUnaryTransport.go 0 → 100644
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var b bytes.Buffer
+	b.Write([]byte{0x00})
+	_, err = io.Copy(&b, body)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "failed to read request body")
+	}
+
+	t.writeMessage(int(websocket.MessageBinary), b.Bytes())
+
+	t.CloseSend()
+
+	rc, err := t.Receive(ctx)