diff --git a/gmid.h b/gmid.h
index 5f6b000..d028115 100644
--- a/gmid.h
+++ b/gmid.h
@@ -100,6 +100,7 @@ extern struct fcgi fcgi[FCGI_MAX];
 struct proxy {
 	char		*host;
 	const char	*port;
+	uint32_t	 protocols;
 	int		 noverifyname;
 	uint8_t		*cert;
 	size_t		 certlen;
diff --git a/parse.y b/parse.y
index d215006..6359227 100644
--- a/parse.y
+++ b/parse.y
@@ -309,6 +309,12 @@ proxy_opt	: CERT string {
 			if (p->key == NULL)
 				yyerror("can't load key %s", $2);
 		}
+		| PROTOCOLS string {
+			struct proxy *p = &host->proxy;
+
+			if (tls_config_parse_protocols(&p->protocols, $2) == -1)
+				yyerror("invalid protocols string \"%s\"", $2);
+		}
 		| RELAY_TO string {
 			char		*at;
 			const char	*errstr;
@@ -961,7 +967,11 @@ symget(const char *nam)
 struct vhost *
 new_vhost(void)
 {
-	return xcalloc(1, sizeof(struct vhost));
+	struct vhost *v;
+
+	v = xcalloc(1, sizeof(*v));
+	v->proxy.protocols = TLS_PROTOCOLS_DEFAULT;
+	return v;
 }
 
 struct location *
diff --git a/proxy.c b/proxy.c
index 87791de..7face97 100644
--- a/proxy.c
+++ b/proxy.c
@@ -295,8 +295,8 @@ proxy_init(struct client *c)
 	if (p->noverifyname)
 		tls_config_insecure_noverifyname(conf);
 
-	/* TODO: tls_config_set_protocols here */
 	tls_config_insecure_noverifycert(conf);
+	tls_config_set_protocols(conf, p->protocols);
 
 	if (p->cert != NULL) {
 		int r;