diff --git a/README.lwsws.md b/README.lwsws.md
index 8600596ee..d47e6ea1a 100644
--- a/README.lwsws.md
+++ b/README.lwsws.md
@@ -190,6 +190,13 @@ Other vhost options
 
  - `"enable-client-ssl"`: `"1"` enables the vhost's client SSL context, you will need this if you plan to create client conections on the vhost that will use SSL.  You don't need it if you only want http / ws client connections.
 
+ - "`ciphers`": "<cipher list>"   sets the allowed list of ciphers and key exchange protocols for the vhost.  The default list is restricted to only those providing PFS (Perfect Forward Secrecy) on the author's Fedora system.
+ 
+ If you need to allow weaker ciphers,you can provide an alternative list here per-vhost.
+ 
+ - "`ecdh-curve`": "<curve name>"   The default ecdh curve is "prime256v1", but you can override it here, per-vhost
+
+
 Mounts
 ------
 
diff --git a/lwsws/conf.c b/lwsws/conf.c
index 17c2d9db2..6ce8ef030 100644
--- a/lwsws/conf.c
+++ b/lwsws/conf.c
@@ -65,6 +65,8 @@ static const char * const paths_vhosts[] = {
 	"vhosts[].ws-protocols[]",
 	"vhosts[].keepalive_timeout",
 	"vhosts[].enable-client-ssl",
+	"vhosts[].ciphers",
+	"vhosts[].ecdh-curve",
 };
 
 enum lejp_vhost_paths {
@@ -93,6 +95,8 @@ enum lejp_vhost_paths {
 	LEJPVP_PROTOCOL,
 	LEJPVP_KEEPALIVE_TIMEOUT,
 	LEJPVP_ENABLE_CLIENT_SSL,
+	LEJPVP_CIPHERS,
+	LEJPVP_ECDH_CURVE,
 };
 
 #define MAX_PLUGIN_DIRS 10
@@ -389,6 +393,12 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 	case LEJPVP_KEEPALIVE_TIMEOUT:
 		a->info->keepalive_timeout = atoi(ctx->buf);
 		return 0;
+	case LEJPVP_CIPHERS:
+		a->info->ssl_cipher_list = a->p;
+		break;
+	case LEJPVP_ECDH_CURVE:
+		a->info->ecdh_curve = a->p;
+		break;
 	case LEJPVP_CGI_ENV:
 		mp_cgienv = lwsws_align(a);
 		a->p += sizeof(*a->m.cgienv);