diff --git a/protocol/trusttunnel/inbound.go b/protocol/trusttunnel/inbound.go
index e6ad9b15..7e02504e 100644
--- a/protocol/trusttunnel/inbound.go
+++ b/protocol/trusttunnel/inbound.go
@@ -89,6 +89,15 @@ func (h *Inbound) Start(stage adapter.StartStage) error {
 	}
 	var err error
 	if common.Contains(h.network, N.NetworkTCP) {
+		h.httpTLSConfig, err = tls.NewServer(h.ctx, h.logger, common.PtrValueOrDefault(h.options.TLS))
+		if err != nil {
+			return err
+		}
+		if len(h.httpTLSConfig.NextProtos()) == 0 {
+			h.httpTLSConfig.SetNextProtos([]string{http2.NextProtoTLS})
+		} else if !common.Contains(h.httpTLSConfig.NextProtos(), http2.NextProtoTLS) {
+			h.httpTLSConfig.SetNextProtos(append([]string{http2.NextProtoTLS}, h.httpTLSConfig.NextProtos()...))
+		}
 		listener, err := h.listener.ListenTCP()
 		if err != nil {
 			return err
@@ -99,15 +108,6 @@ func (h *Inbound) Start(stage adapter.StartStage) error {
 				return h.ctx
 			},
 		}
-		h.httpTLSConfig, err = tls.NewServer(h.ctx, h.logger, common.PtrValueOrDefault(h.options.TLS))
-		if err != nil {
-			return err
-		}
-		if len(h.httpTLSConfig.NextProtos()) == 0 {
-			h.httpTLSConfig.SetNextProtos([]string{http2.NextProtoTLS})
-		} else if !common.Contains(h.httpTLSConfig.NextProtos(), http2.NextProtoTLS) {
-			h.httpTLSConfig.SetNextProtos(append([]string{http2.NextProtoTLS}, h.httpTLSConfig.NextProtos()...))
-		}
 		err = h.httpTLSConfig.Start()
 		if err != nil {
 			return err