diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index 6f59a18a0..3afedea29 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -15,6 +15,7 @@ Plugin Changelog
 * Change all Listen Port directives to Listen Address and migrate the Port data to Addresses
 * Add default_server option to HTTP Server
 * Replace stop action by the reload option in reconfigureForceRestart (#2450)
+* Add server ssl_protocols, ssl_ciphers, ssl_prefer_server_ciphers directives to GUI
 
 1.23
 
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
index 2809f56c9..533f4d743 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
@@ -143,6 +143,35 @@
     <type>checkbox</type>
     <help>If you check this box, a TLS encrypted connection is enforced.</help>
   </field>
+  <field>
+    <id>httpserver.tls_protocols</id>
+    <label>TLS Protocols</label>
+    <style>selectpicker</style>
+    <type>select_multiple</type>
+    <advanced>true</advanced>
+    <help>Enable specified protocols. Default: TLSv1.2 TLSv1.3. TLSv1 and TLSv1.1 are insecure and excluded from GUI.</help>
+  </field> 
+  <field>
+    <id>httpserver.tls_ciphers</id>
+    <label>TLS Ciphers</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>Specify enabled ciphers in the TLS library cipher string format. Example: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256. NGINX default (empty field): HIGH:!aNULL:!MD5.</help>
+  </field>
+  <field>
+    <id>httpserver.tls_ecdh_curve</id>
+    <label>ECDH curve</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>Specify a curve(s) for ECDHE ciphers. NGINX default (empty field): auto.</help>
+  </field>
+  <field>
+    <id>httpserver.tls_prefer_server_ciphers</id>
+    <label>Prefer server ciphers</label>
+    <type>checkbox</type>
+    <advanced>true</advanced>
+    <help>Prefers server ciphers over client ciphers.</help>
+  </field>
   <field>
     <id>httpserver.ocsp_stapling</id>
     <label>OCSP Stapling</label>
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index 0bea091e0..07411f856 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -793,6 +793,29 @@
         <default>0</default>
         <Required>Y</Required>
       </https_only>
+      <tls_protocols type="OptionField">
+        <multiple>Y</multiple>
+        <Sorted>Y</Sorted>
+        <OptionValues>
+          <TLSv1_2 value="TLSv1.2">TLSv1.2</TLSv1_2>
+          <TLSv1_3 value="TLSv1.3">TLSv1.3</TLSv1_3>
+        </OptionValues>
+        <Required>Y</Required>
+        <default>TLSv1.2,TLSv1.3</default>
+      </tls_protocols>
+      <tls_ciphers type="TextField">
+        <default>ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256</default>
+        <Required>N</Required>
+        <mask>/^((((!|\+|-)?[A-Z][A-Z\d\+-]+)|(@STRENGTH)):?)*$/i</mask>
+      </tls_ciphers>
+      <tls_ecdh_curve type="TextField">
+        <Required>N</Required>
+        <mask>/^(([A-Z\d-]+):?)*$/i</mask>
+      </tls_ecdh_curve>
+      <tls_prefer_server_ciphers type="BooleanField">
+        <default>1</default>
+        <Required>Y</Required>
+      </tls_prefer_server_ciphers>
       <ocsp_stapling type="BooleanField">
         <default>0</default>
         <Required>Y</Required>
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index 243777d2e..287b6893a 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -110,13 +110,18 @@ server {
 {%     endif %}
     ssl_certificate_key /usr/local/etc/nginx/key/{{ single_servername }}.key;
     ssl_certificate /usr/local/etc/nginx/key/{{ single_servername }}.pem;
-    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_protocols {{ server.tls_protocols.replace(',', ' ') }};
     ssl_dhparam /usr/local/etc/dh-parameters.4096;
-    ssl_ciphers 'ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256';
+{%     if server.tls_ciphers is defined and server.tls_ciphers != '' %}
+    ssl_ciphers {{ server.tls_ciphers }};
+{%     endif %}
+{%     if server.tls_ecdh_curve is defined and server.tls_ecdh_curve != '' %}
+    ssl_ecdh_curve {{ server.tls_ecdh_curve }};
+{%     endif %}
     ssl_session_timeout 1d;
     ssl_session_cache shared:SSL:50m;
     ssl_session_tickets off;
-    ssl_prefer_server_ciphers on;
+    ssl_prefer_server_ciphers {% if server.tls_prefer_server_ciphers is defined and server.tls_prefer_server_ciphers == '0'%}off{% else %}on{% endif %};
 {%     if server.ocsp_stapling is defined and server.ocsp_stapling == '1'%}
     ssl_stapling on;
     ssl_stapling_verify {% if server.ocsp_verify is defined and server.ocsp_verify == '1' %}On{% else %}Off{% endif %};