diff --git a/include/libwebsockets/lws-secure-streams.h b/include/libwebsockets/lws-secure-streams.h
index ee26e6d49..c62ff5c8f 100644
--- a/include/libwebsockets/lws-secure-streams.h
+++ b/include/libwebsockets/lws-secure-streams.h
@@ -410,6 +410,17 @@ lws_ss_state_name(int state);
 LWS_VISIBLE LWS_EXTERN struct lws_context *
 lws_ss_get_context(struct lws_ss_handle *h);
 
+/**
+ * lws_ss_get_vhost() - convenience helper to get the vhost the ss is bound to
+ *
+ * \param h: secure streams handle
+ *
+ * Returns NULL if disconnected, or the the lws_vhost of the ss' wsi connection. 
+ */
+LWS_VISIBLE LWS_EXTERN struct lws_vhost *
+lws_ss_get_vhost(struct lws_ss_handle *h);
+
+
 #define LWSSS_TIMEOUT_FROM_POLICY				0
 
 /**
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 6b98f9d5d..c452f9908 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -1933,6 +1933,15 @@ lws_ss_get_context(struct lws_ss_handle *h)
 	return h->context;
 }
 
+struct lws_vhost *
+lws_ss_get_vhost(struct lws_ss_handle *h)
+{
+	if (!h->wsi)
+		return NULL;
+	return h->wsi->a.vhost;
+}
+
+
 const char *
 lws_ss_rideshare(struct lws_ss_handle *h)
 {