diff --git a/nova/files/queens/nova-controller.conf.Debian b/nova/files/queens/nova-controller.conf.Debian
index b82ef1e..997a189 100644
--- a/nova/files/queens/nova-controller.conf.Debian
+++ b/nova/files/queens/nova-controller.conf.Debian
@@ -3039,6 +3039,12 @@
 ssl_only=True
 cert={{controller.novncproxy.tls.server.cert_file|yaml_squote}}
 key={{controller.novncproxy.tls.server.key_file|yaml_squote}}
+{%- if controller.novncproxy.tls.version is defined %}
+ssl_version={{controller.novncproxy.tls.version}}
+{%- endif %}
+{% if controller.novncproxy.tls.ciphers is defined %}
+ssl_ciphers={{controller.novncproxy.tls.ciphers|join(',')}}
+{%- endif %}
 {%- endif %}
 
 # Set to True if source host is addressed with IPv6. (boolean value)
@@ -3050,6 +3056,23 @@
 # SSL key file (if separate from cert). (string value)
 #key = <None>
 
+# List of SSL ciphers allowed for novnc connection.
+# For a list of supported ciphers run `openssl ciphers`.
+#  (list value)
+#ssl_ciphers=
+
+# SSL version for novnc console.
+# Depending on your Python version the actually available version
+# may not be the maximal one. In this case graceful fallback to the most
+# recent supported version will be performed.
+#  (string value)
+# Possible values:
+# default - <No description provided>
+# tlsv1_1 - <No description provided>
+# tlsv1_2 - <No description provided>
+# tlsv1_3 - <No description provided>
+#ssl_version=default
+
 #
 # Path to directory with content which will be served by a web server.
 #  (string value)