diff --git a/common.go b/common.go
index e8d0091..e4f18bf 100644
--- a/common.go
+++ b/common.go
@@ -727,9 +727,12 @@ func (c *Config) ticketKeyFromBytes(b [32]byte) (key ticketKey) {
 // ticket, and the lifetime we set for tickets we send.
 const maxSessionTicketLifetime = 7 * 24 * time.Hour
 
-// Clone returns a shallow clone of c. It is safe to clone a Config that is
+// Clone returns a shallow clone of c or nil if c is nil. It is safe to clone a Config that is
 // being used concurrently by a TLS client or server.
 func (c *Config) Clone() *Config {
+	if c == nil {
+		return nil
+	}
 	c.mutex.RLock()
 	defer c.mutex.RUnlock()
 	return &Config{
diff --git a/tls_test.go b/tls_test.go
index 334bfc4..4ab8a43 100644
--- a/tls_test.go
+++ b/tls_test.go
@@ -841,6 +841,13 @@ func TestCloneNonFuncFields(t *testing.T) {
 	}
 }
 
+func TestCloneNilConfig(t *testing.T) {
+	var config *Config
+	if cc := config.Clone(); cc != nil {
+		t.Fatalf("Clone with nil should return nil, got: %+v", cc)
+	}
+}
+
 // changeImplConn is a net.Conn which can change its Write and Close
 // methods.
 type changeImplConn struct {