diff --git a/lib/lejp-conf.c b/lib/lejp-conf.c
index 531f93be..6fc358fe 100644
--- a/lib/lejp-conf.c
+++ b/lib/lejp-conf.c
@@ -95,6 +95,10 @@ static const char * const paths_vhosts[] = {
 	"vhosts[].mounts[].pmo[].*",
 	"vhosts[].headers[].*",
 	"vhosts[].headers[]",
+	"vhosts[].client-ssl-key",
+	"vhosts[].client-ssl-cert",
+	"vhosts[].client-ssl-ca",
+	"vhosts[].client-ssl-ciphers",
 };
 
 enum lejp_vhost_paths {
@@ -137,6 +141,10 @@ enum lejp_vhost_paths {
 	LEJPVP_PMO,
 	LEJPVP_HEADERS_NAME,
 	LEJPVP_HEADERS,
+	LEJPVP_CLIENT_SSL_KEY,
+	LEJPVP_CLIENT_SSL_CERT,
+	LEJPVP_CLIENT_SSL_CA,
+	LEJPVP_CLIENT_CIPHERS,
 };
 
 static const char * const parser_errs[] = {
@@ -313,6 +321,22 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 		a->info->ssl_cert_filepath = NULL;
 		a->info->ssl_private_key_filepath = NULL;
 		a->info->ssl_ca_filepath = NULL;
+		a->info->client_ssl_cert_filepath = NULL;
+		a->info->client_ssl_private_key_filepath = NULL;
+		a->info->client_ssl_ca_filepath = NULL;
+		a->info->client_ssl_cipher_list = "ECDHE-ECDSA-AES256-GCM-SHA384:"
+			"ECDHE-RSA-AES256-GCM-SHA384:"
+			"DHE-RSA-AES256-GCM-SHA384:"
+			"ECDHE-RSA-AES256-SHA384:"
+			"HIGH:!aNULL:!eNULL:!EXPORT:"
+			"!DES:!MD5:!PSK:!RC4:!HMAC_SHA1:"
+			"!SHA1:!DHE-RSA-AES128-GCM-SHA256:"
+			"!DHE-RSA-AES128-SHA256:"
+			"!AES128-GCM-SHA256:"
+			"!AES128-SHA256:"
+			"!DHE-RSA-AES256-SHA256:"
+			"!AES256-GCM-SHA384:"
+			"!AES256-SHA256";
 		a->info->timeout_secs = 5;
 		a->info->ssl_cipher_list = "ECDHE-ECDSA-AES256-GCM-SHA384:"
 				       "ECDHE-RSA-AES256-GCM-SHA384:"
@@ -406,7 +430,15 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 		a->any_vhosts = 1;
 
 		if (a->enable_client_ssl) {
+			const char *cert_filepath = a->info->client_ssl_cert_filepath;
+			const char *private_key_filepath = a->info->client_ssl_private_key_filepath;
+			const char *ca_filepath = a->info->client_ssl_ca_filepath;
+			const char *cipher_list = a->info->client_ssl_cipher_list;
 			memset(a->info, 0, sizeof(*a->info));
+			a->info->client_ssl_cert_filepath = cert_filepath;
+			a->info->client_ssl_private_key_filepath = private_key_filepath;
+			a->info->client_ssl_ca_filepath = ca_filepath;
+			a->info->client_ssl_cipher_list = cipher_list;
 			a->info->options = LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
 			lws_init_vhost_client_ssl(a->info, vhost);
 		}
@@ -538,6 +570,9 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 	case LEJPVP_KEEPALIVE_TIMEOUT:
 		a->info->keepalive_timeout = atoi(ctx->buf);
 		return 0;
+	case LEJPVP_CLIENT_CIPHERS:
+		a->info->client_ssl_cipher_list = a->p;
+		break;
 	case LEJPVP_CIPHERS:
 		a->info->ssl_cipher_list = a->p;
 		break;
@@ -613,6 +648,15 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 	case LEJPVP_ENABLE_CLIENT_SSL:
 		a->enable_client_ssl = arg_to_bool(ctx->buf);
 		return 0;
+	case LEJPVP_CLIENT_SSL_KEY:
+		a->info->client_ssl_private_key_filepath = a->p;
+		break;
+	case LEJPVP_CLIENT_SSL_CERT:
+		a->info->client_ssl_cert_filepath = a->p;
+		break;
+	case LEJPVP_CLIENT_SSL_CA:
+		a->info->client_ssl_ca_filepath = a->p;
+		break;
 
 	case LEJPVP_NOIPV6:
 		if (arg_to_bool(ctx->buf))
diff --git a/lib/libwebsockets.h b/lib/libwebsockets.h
index 3120bc84..89becac8 100644
--- a/lib/libwebsockets.h
+++ b/lib/libwebsockets.h
@@ -1870,6 +1870,29 @@ struct lws_context_creation_info {
 	 * succeeded to create.
 	 */
 
+#ifdef LWS_OPENSSL_SUPPORT
+	 /**< CONTEXT: NULL or struct lws_token_limits pointer which is initialized
+	 * with a token length limit for each possible WSI_TOKEN_ */
+	const char *client_ssl_private_key_password;
+	/**< VHOST: NULL or the passphrase needed for the private key */
+	const char *client_ssl_cert_filepath;
+	/**< VHOST: If libwebsockets was compiled to use ssl, and you want
+	* to listen using SSL, set to the filepath to fetch the
+	* server cert from, otherwise NULL for unencrypted */
+	const char *client_ssl_private_key_filepath;
+	/**<  VHOST: filepath to private key if wanting SSL mode;
+	* if this is set to NULL but sll_cert_filepath is set, the
+	* OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called
+	* to allow setting of the private key directly via openSSL
+	* library calls */
+	const char *client_ssl_ca_filepath;
+	/**< VHOST: CA certificate filepath or NULL */
+	const char *client_ssl_cipher_list;
+	/**< VHOST: List of valid ciphers to use (eg,
+	* "RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL"
+	* or you can leave it as NULL to get "DEFAULT" */
+#endif
+
 	/* Add new things just above here ---^
 	 * This is part of the ABI, don't needlessly break compatibility
 	 *
diff --git a/lib/ssl-client.c b/lib/ssl-client.c
index 6c3c7095..102a4d3e 100644
--- a/lib/ssl-client.c
+++ b/lib/ssl-client.c
@@ -479,9 +479,9 @@ int lws_context_init_client_ssl(struct lws_context_creation_info *info,
 #endif
 	SSL_CTX_set_options(vhost->ssl_client_ctx,
 			    SSL_OP_CIPHER_SERVER_PREFERENCE);
-	if (info->ssl_cipher_list)
+	if (info->client_ssl_cipher_list)
 		SSL_CTX_set_cipher_list(vhost->ssl_client_ctx,
-						info->ssl_cipher_list);
+						info->client_ssl_cipher_list);
 
 #ifdef LWS_SSL_CLIENT_USE_OS_CA_CERTS
 	if (!lws_check_opt(info->options, LWS_SERVER_OPTION_DISABLE_OS_CA_CERTS))
@@ -490,7 +490,7 @@ int lws_context_init_client_ssl(struct lws_context_creation_info *info,
 #endif
 
 	/* openssl init for cert verification (for client sockets) */
-	if (!info->ssl_ca_filepath) {
+	if (!info->client_ssl_ca_filepath) {
 		if (!SSL_CTX_load_verify_locations(
 			vhost->ssl_client_ctx, NULL,
 					     LWS_OPENSSL_CLIENT_CERTS))
@@ -501,12 +501,12 @@ int lws_context_init_client_ssl(struct lws_context_creation_info *info,
 			    "going to work\n", LWS_OPENSSL_CLIENT_CERTS);
 	} else
 		if (!SSL_CTX_load_verify_locations(
-			vhost->ssl_client_ctx, info->ssl_ca_filepath,
+			vhost->ssl_client_ctx, info->client_ssl_ca_filepath,
 							  NULL)) {
 			lwsl_err(
 				"Unable to load SSL Client certs "
 				"file from %s -- client ssl isn't "
-				"going to work\n", info->ssl_ca_filepath);
+				"going to work\n", info->client_ssl_ca_filepath);
 			lws_ssl_elaborate_error();
 		}
 		else
@@ -518,32 +518,32 @@ int lws_context_init_client_ssl(struct lws_context_creation_info *info,
 	 */
 
 	/* support for client-side certificate authentication */
-	if (info->ssl_cert_filepath) {
+	if (info->client_ssl_cert_filepath) {
 	lwsl_notice("%s: doing cert filepath\n", __func__);
 		n = SSL_CTX_use_certificate_chain_file(vhost->ssl_client_ctx,
-						       info->ssl_cert_filepath);
+						       info->client_ssl_cert_filepath);
 		if (n < 1) {
 			lwsl_err("problem %d getting cert '%s'\n", n,
-				info->ssl_cert_filepath);
+				info->client_ssl_cert_filepath);
 			lws_ssl_elaborate_error();
 			return 1;
 		}
-		lwsl_notice("Loaded client cert %s\n", info->ssl_cert_filepath);
+		lwsl_notice("Loaded client cert %s\n", info->client_ssl_cert_filepath);
 	}
 
-	if (info->ssl_private_key_filepath) {
+	if (info->client_ssl_private_key_filepath) {
 		lwsl_notice("%s: doing private key filepath\n", __func__);
 		lws_ssl_bind_passphrase(vhost->ssl_client_ctx, info);
 		/* set the private key from KeyFile */
 		if (SSL_CTX_use_PrivateKey_file(vhost->ssl_client_ctx,
-		    info->ssl_private_key_filepath, SSL_FILETYPE_PEM) != 1) {
+		    info->client_ssl_private_key_filepath, SSL_FILETYPE_PEM) != 1) {
 			lwsl_err("use_PrivateKey_file '%s'\n",
-				info->ssl_private_key_filepath);
+				info->client_ssl_private_key_filepath);
 			lws_ssl_elaborate_error();
 			return 1;
 		}
 		lwsl_notice("Loaded client cert private key %s\n",
-			    info->ssl_private_key_filepath);
+			    info->client_ssl_private_key_filepath);
 
 		/* verify private key */
 		if (!SSL_CTX_check_private_key(vhost->ssl_client_ctx)) {