diff --git a/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php b/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
index 625bb15f59cb81cb3c8b1d5c7336b7e0fc19663a..92b73eb2e3617879b478764fc9ede14d47dc8e07 100644
--- a/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
+++ b/http/Provision/Config/Nginx/Ssl/vhost_ssl.tpl.php
@@ -1,10 +1,36 @@
 
 <?php if ($this->ssl_enabled && $this->ssl_key) : ?>
 
+<?php
+$satellite_mode = drush_get_option('satellite_mode');
+if (!$satellite_mode && $server->satellite_mode) {
+  $satellite_mode = $server->satellite_mode;
+}
+
+$nginx_has_http2 = drush_get_option('nginx_has_http2');
+if (!$nginx_has_http2 && $server->nginx_has_http2) {
+  $nginx_has_http2 = $server->nginx_has_http2;
+}
+
+if ($nginx_has_http2) {
+  $ssl_args = "ssl http2";
+}
+else {
+  $ssl_args = "ssl";
+}
+
+if ($satellite_mode == 'boa') {
+  $ssl_listen_ip = "*";
+}
+else {
+  $ssl_listen_ip = $ip_address;
+}
+?>
+
 <?php if ($this->redirection): ?>
 <?php foreach ($this->aliases as $alias_url): ?>
 server {
-  listen       <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen       <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
 <?php
   // if we use redirections, we need to change the redirection
   // target to be the original site URL ($this->uri instead of
@@ -61,7 +87,7 @@ server {
   }
 ?>
   fastcgi_param db_port   <?php print urlencode($db_port); ?>;
-  listen        <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen        <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
   server_name   <?php
     // this is the main vhost, so we need to put the redirection
     // target as the hostname (if it exists) and not the original URL
diff --git a/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php b/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
index 1b2209a780ec48c665a92a5e13c2b75afd274596..491598b4248f99c860751592859133011d638bcc 100644
--- a/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
+++ b/http/Provision/Config/Nginx/Ssl/vhost_ssl_disabled.tpl.php
@@ -6,10 +6,29 @@ $satellite_mode = drush_get_option('satellite_mode');
 if (!$satellite_mode && $server->satellite_mode) {
   $satellite_mode = $server->satellite_mode;
 }
+
+$nginx_has_http2 = drush_get_option('nginx_has_http2');
+if (!$nginx_has_http2 && $server->nginx_has_http2) {
+  $nginx_has_http2 = $server->nginx_has_http2;
+}
+
+if ($nginx_has_http2) {
+  $ssl_args = "ssl http2";
+}
+else {
+  $ssl_args = "ssl";
+}
+
+if ($satellite_mode == 'boa') {
+  $ssl_listen_ip = "*";
+}
+else {
+  $ssl_listen_ip = $ip_address;
+}
 ?>
 
 server {
-  listen       <?php print "{$ip_address}:{$http_ssl_port}"; ?>;
+  listen       <?php print "{$ssl_listen_ip}:{$http_ssl_port} {$ssl_args}"; ?>;
   server_name  <?php print $this->uri . ' ' . implode(' ', str_replace('/', '.', $this->aliases)); ?>;
 <?php if ($satellite_mode == 'boa'): ?>
   root         /var/www/nginx-default;