diff --git a/src/proxy/http_connect.rs b/src/proxy/http_connect.rs
index 574c2d1..0a3e041 100644
--- a/src/proxy/http_connect.rs
+++ b/src/proxy/http_connect.rs
@@ -18,7 +18,7 @@ use hyper::{
 use hyper_util::rt::{TokioExecutor, TokioIo};
 use std::io;
 use std::sync::Arc;
-use tokio::io::{AsyncRead, AsyncWrite};
+use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::sync::RwLock;
 use tracing::{debug, error, info, warn};
@@ -316,6 +316,13 @@ async fn handle_http_request(
                 if let Err(e) = tokio::io::copy_bidirectional(&mut client, &mut *stream).await {
                     error!("CONNECT tunnel error: {}", e);
                 }
+
+                // Send close_notify on TLS streams
+                // Send TCP FIN otherwise
+                // See https://github.com/rustls/tokio-rustls/blob/182345793062971bec711c2d773e75a08767eeeb/src/client.rs#L459
+                if let Err(e) = stream.shutdown().await {
+                    debug!("CONNECT upstream shutdown error: {}", e);
+                }
             }
             Err(e) => debug!("CONNECT upgrade error: {}", e),
         }