diff --git a/README.rst b/README.rst
index f15f41e..fc58787 100644
--- a/README.rst
+++ b/README.rst
@@ -1087,6 +1087,59 @@
             key: (certificate content)
             cert: (certificate content)
 
+It is possible to limit allowed SSL / TLS ciphers using libvirt's tls_priority:
+
+.. code-block:: yaml
+
+  nova:
+    compute:
+      libvirt:
+        tls:
+          priority: <TLS priority string>
+
+Example priority strings are:
+
+- The system imposed security level:
+
+.. code-block:: text
+
+  "SYSTEM"
+
+- The default priority without the HMAC-MD5:
+
+.. code-block:: text
+
+  "NORMAL:-MD5"
+
+- Specifying RSA with AES-128-CBC:
+
+.. code-block:: text
+
+  "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"
+
+- Specifying the defaults plus ARCFOUR-128:
+
+.. code-block:: text
+
+  "NORMAL:+ARCFOUR-128"
+
+- Enabling the 128-bit secure ciphers, while disabling TLS 1.0:
+
+.. code-block:: text
+
+  "SECURE128:-VERS-TLS1.0"
+
+- Enabling the 128-bit and 192-bit secure ciphers, while disabling all TLS
+  versions except TLS 1.2:
+
+.. code-block:: text
+
+  "SECURE128:+SECURE192:-VERS-ALL:+VERS-TLS1.2"
+
+More on TLS Priority Strings:
+
+- https://gnutls.org/manual/html_node/Priority-Strings.html
+
 Controlling access by `tls_allowed_dn_list`.
 Enable an access control list of client certificate Distinguished Names (DNs)
 which can connect to the TLS port on this server. The default is that DNs are