diff --git a/CHANGES.txt b/CHANGES.txt
index 8e38818..a457c5d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,5 +1,6 @@
 1.0.0
 -----
+ * Expose additional SSL configuration options for the Sidecar Service (CASSANDRASC-82)
  * Expose additional node settings (CASSANDRASC-84)
  * Sidecar does not handle keyspaces and table names with mixed case (CASSANDRASC-76)
  * Require gossip to be enabled for ring and token ranges mapping endpoints (CASSANDRASC-83)
diff --git a/src/main/dist/conf/sidecar.yaml b/src/main/dist/conf/sidecar.yaml
index 884e183..6104f69 100644
--- a/src/main/dist/conf/sidecar.yaml
+++ b/src/main/dist/conf/sidecar.yaml
@@ -113,7 +113,12 @@
 #    use_openssl: true
 #    handshake_timeout_sec: 10
 #    client_auth: NONE # valid options are NONE, REQUEST, REQUIRED
+#    accepted_protocols:
+#     - TLSv1.2
+#     - TLSv1.3
+#    cipher_suites: []
 #    keystore:
+#      type: PKCS12
 #      path: "path/to/keystore.p12"
 #      password: password
 #      check_interval_sec: 300
diff --git a/src/main/java/org/apache/cassandra/sidecar/config/SslConfiguration.java b/src/main/java/org/apache/cassandra/sidecar/config/SslConfiguration.java
index 768d197..2205e35 100644
--- a/src/main/java/org/apache/cassandra/sidecar/config/SslConfiguration.java
+++ b/src/main/java/org/apache/cassandra/sidecar/config/SslConfiguration.java
@@ -18,6 +18,8 @@
 
 package org.apache.cassandra.sidecar.config;
 
+import java.util.List;
+
 /**
  * Encapsulates SSL Configuration
  */
@@ -54,6 +56,22 @@
     String clientAuth();
 
     /**
+     * Return a list of the enabled cipher suites. The list of cipher suites must be provided in the
+     * desired order for its intended use.
+     *
+     * @return the enabled cipher suites
+     */
+    List<String> cipherSuites();
+
+    /**
+     * Returns a list of enabled SSL/TLS protocols. The list of accepted protocols must be provided in the
+     * desired order of use.
+     *
+     * @return the enabled SSL/TLS protocols
+     */
+    List<String> secureTransportProtocols();
+
+    /**
      * @return {@code true} if the keystore is configured, and the {@link KeyStoreConfiguration#path()} and
      * {@link KeyStoreConfiguration#password()} parameters are provided
      */
diff --git a/src/main/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImpl.java b/src/main/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImpl.java
index fbb7677..0239121 100644
--- a/src/main/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImpl.java
+++ b/src/main/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImpl.java
@@ -18,7 +18,10 @@
 
 package org.apache.cassandra.sidecar.config.yaml;
 
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 import java.util.stream.Collectors;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -36,6 +39,8 @@
     public static final boolean DEFAULT_USE_OPEN_SSL = true;
     public static final long DEFAULT_HANDSHAKE_TIMEOUT_SECONDS = 10L;
     public static final String DEFAULT_CLIENT_AUTH = "NONE";
+    public static final List<String> DEFAULT_SECURE_TRANSPORT_PROTOCOLS
+    = Collections.unmodifiableList(Arrays.asList("TLSv1.2", "TLSv1.3"));
 
 
     @JsonProperty("enabled")
@@ -49,6 +54,12 @@
 
     protected String clientAuth;
 
+    @JsonProperty(value = "cipher_suites")
+    protected final List<String> cipherSuites;
+
+    @JsonProperty(value = "accepted_protocols")
+    protected final List<String> secureTransportProtocols;
+
     @JsonProperty("keystore")
     protected final KeyStoreConfiguration keystore;
 
@@ -68,6 +79,8 @@
         setClientAuth(builder.clientAuth);
         keystore = builder.keystore;
         truststore = builder.truststore;
+        cipherSuites = builder.cipherSuites;
+        secureTransportProtocols = builder.secureTransportProtocols;
     }
 
     /**
@@ -100,6 +113,9 @@
         return handshakeTimeoutInSeconds;
     }
 
+    /**
+     * {@inheritDoc}
+     */
     @Override
     @JsonProperty(value = "client_auth", defaultValue = "NONE")
     public String clientAuth()
@@ -131,6 +147,26 @@
      * {@inheritDoc}
      */
     @Override
+    @JsonProperty(value = "cipher_suites")
+    public List<String> cipherSuites()
+    {
+        return cipherSuites;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    @JsonProperty(value = "accepted_protocols")
+    public List<String> secureTransportProtocols()
+    {
+        return secureTransportProtocols;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
     @JsonProperty("keystore")
     public KeyStoreConfiguration keystore()
     {
@@ -166,12 +202,14 @@
      */
     public static class Builder implements DataObjectBuilder<Builder, SslConfigurationImpl>
     {
-        private boolean enabled = DEFAULT_SSL_ENABLED;
-        private boolean useOpenSsl = DEFAULT_USE_OPEN_SSL;
-        private long handshakeTimeoutInSeconds = DEFAULT_HANDSHAKE_TIMEOUT_SECONDS;
-        private String clientAuth = DEFAULT_CLIENT_AUTH;
-        private KeyStoreConfiguration keystore = null;
-        private KeyStoreConfiguration truststore = null;
+        protected boolean enabled = DEFAULT_SSL_ENABLED;
+        protected boolean useOpenSsl = DEFAULT_USE_OPEN_SSL;
+        protected long handshakeTimeoutInSeconds = DEFAULT_HANDSHAKE_TIMEOUT_SECONDS;
+        protected String clientAuth = DEFAULT_CLIENT_AUTH;
+        protected List<String> cipherSuites = Collections.emptyList();
+        protected List<String> secureTransportProtocols = DEFAULT_SECURE_TRANSPORT_PROTOCOLS;
+        protected KeyStoreConfiguration keystore = null;
+        protected KeyStoreConfiguration truststore = null;
 
         protected Builder()
         {
@@ -191,8 +229,7 @@
          */
         public Builder enabled(boolean enabled)
         {
-            this.enabled = enabled;
-            return this;
+            return update(b -> b.enabled = enabled);
         }
 
         /**
@@ -203,8 +240,7 @@
          */
         public Builder useOpenSsl(boolean useOpenSsl)
         {
-            this.useOpenSsl = useOpenSsl;
-            return this;
+            return update(b -> b.useOpenSsl = useOpenSsl);
         }
 
         /**
@@ -215,8 +251,7 @@
          */
         public Builder handshakeTimeoutInSeconds(long handshakeTimeoutInSeconds)
         {
-            this.handshakeTimeoutInSeconds = handshakeTimeoutInSeconds;
-            return this;
+            return update(b -> b.handshakeTimeoutInSeconds = handshakeTimeoutInSeconds);
         }
 
         /**
@@ -227,8 +262,29 @@
          */
         public Builder clientAuth(String clientAuth)
         {
-            this.clientAuth = clientAuth;
-            return this;
+            return update(b -> b.clientAuth = clientAuth);
+        }
+
+        /**
+         * Sets the {@code cipherSuites} and returns a reference to this Builder enabling method chaining.
+         *
+         * @param cipherSuites the {@code cipherSuites} to set
+         * @return a reference to this Builder
+         */
+        public Builder cipherSuites(List<String> cipherSuites)
+        {
+            return update(b -> b.cipherSuites = new ArrayList<>(cipherSuites));
+        }
+
+        /**
+         * Sets the {@code secureTransportProtocols} and returns a reference to this Builder enabling method chaining.
+         *
+         * @param secureTransportProtocols the {@code secureTransportProtocols} to set
+         * @return a reference to this Builder
+         */
+        public Builder secureTransportProtocols(List<String> secureTransportProtocols)
+        {
+            return update(b -> b.secureTransportProtocols = new ArrayList<>(secureTransportProtocols));
         }
 
         /**
@@ -239,8 +295,7 @@
          */
         public Builder keystore(KeyStoreConfiguration keystore)
         {
-            this.keystore = keystore;
-            return this;
+            return update(b -> b.keystore = keystore);
         }
 
         /**
@@ -251,8 +306,7 @@
          */
         public Builder truststore(KeyStoreConfiguration truststore)
         {
-            this.truststore = truststore;
-            return this;
+            return update(b -> b.truststore = truststore);
         }
 
         /**
diff --git a/src/main/java/org/apache/cassandra/sidecar/server/HttpServerOptionsProvider.java b/src/main/java/org/apache/cassandra/sidecar/server/HttpServerOptionsProvider.java
index 6ee3e65..fad0b81 100644
--- a/src/main/java/org/apache/cassandra/sidecar/server/HttpServerOptionsProvider.java
+++ b/src/main/java/org/apache/cassandra/sidecar/server/HttpServerOptionsProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.cassandra.sidecar.server;
 
+import java.util.LinkedHashSet;
 import java.util.function.Function;
 
 import org.apache.commons.lang3.SystemUtils;
@@ -71,7 +72,14 @@
         if (ssl != null && ssl.enabled())
         {
             options.setClientAuth(ClientAuth.valueOf(ssl.clientAuth()))
-                   .setSsl(true);
+                   .setSsl(true)
+                   // Use LinkedHashSet to preserve input order
+                   .setEnabledSecureTransportProtocols(new LinkedHashSet<>(ssl.secureTransportProtocols()));
+
+            for (String cipherSuite : ssl.cipherSuites())
+            {
+                options.addEnabledCipherSuite(cipherSuite);
+            }
 
             if (ssl.preferOpenSSL() && OpenSSLEngineOptions.isAvailable())
             {
diff --git a/src/test/integration/org/apache/cassandra/sidecar/IntegrationTestBase.java b/src/test/integration/org/apache/cassandra/sidecar/IntegrationTestBase.java
index 01459d3..32dd6a8 100644
--- a/src/test/integration/org/apache/cassandra/sidecar/IntegrationTestBase.java
+++ b/src/test/integration/org/apache/cassandra/sidecar/IntegrationTestBase.java
@@ -92,7 +92,7 @@
         integrationTestModule.setCassandraTestContext(sidecarTestContext);
 
         server = injector.getInstance(Server.class);
-
+        client = WebClient.create(vertx);
         VertxTestContext context = new VertxTestContext();
 
         if (sidecarTestContext.isClusterBuilt())
diff --git a/src/test/java/org/apache/cassandra/sidecar/config/SidecarConfigurationTest.java b/src/test/java/org/apache/cassandra/sidecar/config/SidecarConfigurationTest.java
index b0378a7..23d7001 100644
--- a/src/test/java/org/apache/cassandra/sidecar/config/SidecarConfigurationTest.java
+++ b/src/test/java/org/apache/cassandra/sidecar/config/SidecarConfigurationTest.java
@@ -193,16 +193,16 @@
         assertThat(i1.jmxRolePassword()).isEqualTo("controlPassword");
 
         // service configuration
-        validateDefaultServiceConfiguration(config.serviceConfiguration());
+        validateServiceConfigurationFromYaml(config.serviceConfiguration());
 
         // ssl configuration
         assertThat(config.sslConfiguration()).isNull();
 
         // health check configuration
-        validateHealthCheckConfiguration(config.healthCheckConfiguration());
+        validateHealthCheckConfigurationFromYaml(config.healthCheckConfiguration());
 
         // cassandra input validation configuration
-        validateDefaultCassandraInputValidationConfiguration(config.cassandraInputValidationConfiguration());
+        validateCassandraInputValidationConfigurationFromYaml(config.cassandraInputValidationConfiguration());
     }
 
     void validateMultipleInstancesSidecarConfiguration(SidecarConfiguration config, boolean withSslConfiguration)
@@ -251,12 +251,12 @@
         assertThat(i3.jmxSslEnabled()).isFalse();
 
         // service configuration
-        validateDefaultServiceConfiguration(config.serviceConfiguration());
+        validateServiceConfigurationFromYaml(config.serviceConfiguration());
 
         // ssl configuration
         if (withSslConfiguration)
         {
-            validateDefaultSslConfiguration(config.sslConfiguration());
+            validateSslConfigurationFromYaml(config.sslConfiguration());
         }
         else
         {
@@ -264,13 +264,13 @@
         }
 
         // health check configuration
-        validateHealthCheckConfiguration(config.healthCheckConfiguration());
+        validateHealthCheckConfigurationFromYaml(config.healthCheckConfiguration());
 
         // cassandra input validation configuration
-        validateDefaultCassandraInputValidationConfiguration(config.cassandraInputValidationConfiguration());
+        validateCassandraInputValidationConfigurationFromYaml(config.cassandraInputValidationConfiguration());
     }
 
-    void validateDefaultServiceConfiguration(ServiceConfiguration serviceConfiguration)
+    void validateServiceConfigurationFromYaml(ServiceConfiguration serviceConfiguration)
     {
         assertThat(serviceConfiguration).isNotNull();
         assertThat(serviceConfiguration.host()).isEqualTo("0.0.0.0");
@@ -299,14 +299,14 @@
         assertThat(trafficShaping.checkIntervalForStatsMillis()).isEqualTo(3000L);
     }
 
-    private void validateHealthCheckConfiguration(HealthCheckConfiguration config)
+    private void validateHealthCheckConfigurationFromYaml(HealthCheckConfiguration config)
     {
         assertThat(config).isNotNull();
         assertThat(config.initialDelayMillis()).isEqualTo(100);
         assertThat(config.checkIntervalMillis()).isEqualTo(30_000);
     }
 
-    void validateDefaultCassandraInputValidationConfiguration(CassandraInputValidationConfiguration config)
+    void validateCassandraInputValidationConfigurationFromYaml(CassandraInputValidationConfiguration config)
     {
         assertThat(config).isNotNull();
         assertThat(config.forbiddenKeyspaces()).containsExactlyInAnyOrder("system_schema",
@@ -323,7 +323,7 @@
         assertThat(config.allowedPatternForRestrictedComponentName()).isEqualTo("[a-zA-Z0-9_-]+(.db|TOC.txt)");
     }
 
-    void validateDefaultSslConfiguration(SslConfiguration config)
+    void validateSslConfigurationFromYaml(SslConfiguration config)
     {
         assertThat(config).isNotNull();
         assertThat(config.enabled()).isTrue();
@@ -331,6 +331,7 @@
         assertThat(config.handshakeTimeoutInSeconds()).isEqualTo(25L);
         assertThat(config.clientAuth()).isEqualTo("REQUEST");
         assertThat(config.keystore()).isNotNull();
+        assertThat(config.keystore().type()).isEqualTo("PKCS12");
         assertThat(config.keystore().path()).isEqualTo("path/to/keystore.p12");
         assertThat(config.keystore().password()).isEqualTo("password");
         assertThat(config.keystore().reloadStore()).isTrue();
@@ -340,6 +341,15 @@
         assertThat(config.truststore().password()).isEqualTo("password");
         assertThat(config.truststore().reloadStore()).isFalse();
         assertThat(config.truststore().checkIntervalInSeconds()).isEqualTo(-1);
+        assertThat(config.secureTransportProtocols()).containsExactly("TLSv1.3");
+        assertThat(config.cipherSuites()).contains("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                                   "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                                   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                                   "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                                   "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                                   "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                                   "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                                   "TLS_RSA_WITH_AES_256_CBC_SHA");
     }
 
     private Path yaml(String resourceName)
diff --git a/src/test/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImplTest.java b/src/test/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImplTest.java
new file mode 100644
index 0000000..d38bc5a
--- /dev/null
+++ b/src/test/java/org/apache/cassandra/sidecar/config/yaml/SslConfigurationImplTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.cassandra.sidecar.config.yaml;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Unit tests for {@link SslConfigurationImpl}
+ */
+class SslConfigurationImplTest
+{
+    @Test
+    void testDefaults()
+    {
+        SslConfigurationImpl sslConfiguration = new SslConfigurationImpl();
+        assertThat(sslConfiguration).isNotNull();
+        assertThat(sslConfiguration.enabled()).isFalse();
+        assertThat(sslConfiguration.preferOpenSSL()).isTrue();
+        assertThat(sslConfiguration.handshakeTimeoutInSeconds()).isEqualTo(10);
+        assertThat(sslConfiguration.clientAuth()).isEqualTo("NONE");
+        assertThat(sslConfiguration.cipherSuites()).isEmpty();
+        assertThat(sslConfiguration.secureTransportProtocols()).containsExactly("TLSv1.2", "TLSv1.3");
+        assertThat(sslConfiguration.keystore()).isNull();
+        assertThat(sslConfiguration.isTrustStoreConfigured()).isFalse();
+        assertThat(sslConfiguration.truststore()).isNull();
+    }
+}
diff --git a/src/test/java/org/apache/cassandra/sidecar/server/ServerSSLTest.java b/src/test/java/org/apache/cassandra/sidecar/server/ServerSSLTest.java
index 82cc746..f5001af 100644
--- a/src/test/java/org/apache/cassandra/sidecar/server/ServerSSLTest.java
+++ b/src/test/java/org/apache/cassandra/sidecar/server/ServerSSLTest.java
@@ -342,6 +342,43 @@
     }
 
     @Test
+    void failsOnClientUsingUnacceptableProtocol(VertxTestContext context)
+    {
+        SslConfigurationImpl ssl =
+        SslConfigurationImpl.builder()
+                            .enabled(true)
+                            .useOpenSsl(true)
+                            .keystore(p12KeyStore)
+                            .truststore(p12TrustStore)
+                            .build();
+
+        builder.sslConfiguration(ssl)
+               .serviceConfiguration(ServiceConfigurationImpl.builder()
+                                                             .host("127.0.0.1")
+                                                             .port(9043)
+                                                             .build());
+
+        server = server();
+
+        // Remove default protocols enabled for the server and only add an unsupported protocol to the client
+        WebClientOptions options = new WebClientOptions().setSsl(true)
+                                                         .addEnabledSecureTransportProtocol("TLSv1.1")
+                                                         .removeEnabledSecureTransportProtocol("TLSv1.2")
+                                                         .removeEnabledSecureTransportProtocol("TLSv1.3");
+        server.start()
+              .compose(s -> validateHealthEndpoint(clientWithP12Keystore(options, true, false)))
+              .onComplete(context.failing(throwable -> {
+                  assertThat(throwable).isNotNull()
+                                       .isInstanceOf(SSLHandshakeException.class)
+                                       .hasMessageContaining("Failed to create SSL connection")
+                                       .hasCauseInstanceOf(SSLHandshakeException.class)
+                                       .hasRootCauseMessage("No appropriate protocol (protocol is disabled " +
+                                                            "or cipher suites are inappropriate)");
+                  context.completeNow();
+              }));
+    }
+
+    @Test
     void testHotReloadOfServerCertificates(VertxTestContext context)
     {
         KeyStoreConfigurationImpl expiredP12KeyStore =
@@ -437,6 +474,11 @@
     WebClient clientWithP12Keystore(boolean includeTrustStore, boolean includeClientKeyStore)
     {
         WebClientOptions options = new WebClientOptions().setSsl(true);
+        return clientWithP12Keystore(options, includeTrustStore, includeClientKeyStore);
+    }
+
+    WebClient clientWithP12Keystore(WebClientOptions options, boolean includeTrustStore, boolean includeClientKeyStore)
+    {
         if (includeTrustStore)
         {
             options.setTrustOptions(new PfxOptions().setPath(trustStoreP12Path.toString())
diff --git a/src/test/resources/config/sidecar_multiple_instances.yaml b/src/test/resources/config/sidecar_multiple_instances.yaml
index 72fc1df..62c8903 100644
--- a/src/test/resources/config/sidecar_multiple_instances.yaml
+++ b/src/test/resources/config/sidecar_multiple_instances.yaml
@@ -112,7 +112,12 @@
 #    use_openssl: true
 #    handshake_timeout_sec: 10
 #    client_auth: NONE # valid options are NONE, REQUEST, REQUIRED
+#    accepted_protocols:
+#     - TLSv1.2
+#     - TLSv1.3
+#    cipher_suites: []
 #    keystore:
+#      type: PKCS12
 #      path: "path/to/keystore.p12"
 #      password: password
 #      check_interval_sec: 300
diff --git a/src/test/resources/config/sidecar_single_instance.yaml b/src/test/resources/config/sidecar_single_instance.yaml
index 64c9bfd..c2d3a85 100644
--- a/src/test/resources/config/sidecar_single_instance.yaml
+++ b/src/test/resources/config/sidecar_single_instance.yaml
@@ -65,7 +65,12 @@
 #    use_openssl: true
 #    handshake_timeout_sec: 10
 #    client_auth: NONE # valid options are NONE, REQUEST, REQUIRED
+#    accepted_protocols:
+#     - TLSv1.2
+#     - TLSv1.3
+#    cipher_suites: []
 #    keystore:
+#      type: PKCS12
 #      path: "path/to/keystore.p12"
 #      password: password
 #      check_interval_sec: 300
diff --git a/src/test/resources/config/sidecar_ssl.yaml b/src/test/resources/config/sidecar_ssl.yaml
index afe7731..bec5ffd 100644
--- a/src/test/resources/config/sidecar_ssl.yaml
+++ b/src/test/resources/config/sidecar_ssl.yaml
@@ -112,7 +112,19 @@
   use_openssl: false
   handshake_timeout_sec: 25
   client_auth: REQUEST # valid options are NONE, REQUEST, REQUIRED
+  accepted_protocols:
+   - TLSv1.3
+  cipher_suites:
+   - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+   - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+   - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+   - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+   - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+   - TLS_RSA_WITH_AES_128_GCM_SHA256
+   - TLS_RSA_WITH_AES_128_CBC_SHA
+   - TLS_RSA_WITH_AES_256_CBC_SHA
   keystore:
+    type: PKCS12
     path: "path/to/keystore.p12"
     password: password
     check_interval_sec: 300