diff --git a/src/tlslib.c b/src/tlslib.c
index 86a2413d..89f518a5 100644
--- a/src/tlslib.c
+++ b/src/tlslib.c
@@ -828,11 +828,15 @@ unsigned i;
 	return retval;
 }
 
+
 size_t tls_get_overhead(gnutls_protocol_t version, gnutls_cipher_algorithm_t cipher, gnutls_mac_algorithm_t mac)
 {
 #if GNUTLS_VERSION_NUMBER >= 0x030207
 	return gnutls_est_record_overhead_size(version, cipher, mac, GNUTLS_COMP_NULL, 0);
 #else
+# if GNUTLS_VERSION_NUMBER < 0x030200
+#  define GNUTLS_DTLS1_2 202
+# endif
 unsigned overhead = 0, t;
 unsigned block_size;
 	block_size = gnutls_cipher_get_block_size(cipher);
@@ -840,9 +844,7 @@ unsigned block_size;
 	switch(version) {
 		case GNUTLS_DTLS0_9:
 		case GNUTLS_DTLS1_0:
-#if GNUTLS_VERSION_NUMBER >= 0x030200
 		case GNUTLS_DTLS1_2:
-#endif
 			overhead += 13;
 			break;
 		default:
diff --git a/src/worker-http.c b/src/worker-http.c
index e7161e2e..b8de1795 100644
--- a/src/worker-http.c
+++ b/src/worker-http.c
@@ -76,7 +76,6 @@ const static struct known_urls_st known_urls[] = {
  * HTTP headers (WTF), and the compression negotiation.
  */
 static const dtls_ciphersuite_st ciphersuites[] = {
-#if GNUTLS_VERSION_NUMBER >= 0x030207
 	{
 	 .oc_name = CS_AES128_GCM,
 	 .gnutls_name =
@@ -84,6 +83,7 @@ static const dtls_ciphersuite_st ciphersuites[] = {
 	 .gnutls_version = GNUTLS_DTLS1_2,
 	 .gnutls_mac = GNUTLS_MAC_AEAD,
 	 .gnutls_cipher = GNUTLS_CIPHER_AES_128_GCM,
+	 .txt_version = "3.2.7",
 	 .server_prio = 90},
 	{
 	 .oc_name = CS_AES256_GCM,
@@ -93,8 +93,8 @@ static const dtls_ciphersuite_st ciphersuites[] = {
 	 .gnutls_mac = GNUTLS_MAC_AEAD,
 	 .gnutls_cipher = GNUTLS_CIPHER_AES_256_GCM,
 	 .server_prio = 80,
+	 .txt_version = "3.2.7",
 	 },
-#endif
 	{
 	 .oc_name = "AES128-SHA",
 	 .gnutls_name =
@@ -256,6 +256,9 @@ void header_value_check(struct worker_st *ws, struct http_req_st *req)
 			     i < sizeof(ciphersuites) / sizeof(ciphersuites[0]);
 			     i++) {
 				if (strcmp(token, ciphersuites[i].oc_name) == 0) {
+					if (ciphersuites[i].txt_version != NULL && gnutls_check_version(ciphersuites[i].txt_version) == NULL)
+						continue; /* not supported */
+
 					if (cand == NULL ||
 					    cand->server_prio <
 					    ciphersuites[i].server_prio) {
diff --git a/src/worker.h b/src/worker.h
index 95845327..d4f31f4c 100644
--- a/src/worker.h
+++ b/src/worker.h
@@ -102,6 +102,7 @@ typedef struct dtls_ciphersuite_st {
 	unsigned gnutls_cipher;
 	unsigned gnutls_mac;
 	unsigned gnutls_version;
+	const char *txt_version;
 } dtls_ciphersuite_st;
 
 #ifdef HAVE_GSSAPI