diff --git a/defaults/main.yml b/defaults/main.yml
index 2d874381..d2d9dd86 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -211,8 +211,11 @@ horizon_wsgi_threads: "{{ [[ansible_facts['processor_vcpus']|default(2) // 2, 1]
 horizon_ssl_cert: /etc/ssl/certs/horizon.pem
 horizon_ssl_key: /etc/ssl/private/horizon.key
 horizon_ssl_ca_cert: /etc/ssl/certs/horizon-ca.pem
-horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1.1') }}"
-horizon_ssl_cipher_suite: "{{ ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS') }}"
+horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1') }}"
+# TLS v1.2 and below
+horizon_ssl_cipher_suite_tls12: "{{ horizon_ssl_cipher_suite | default(ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS')) }}"
+# TLS v1.3
+horizon_ssl_cipher_suite_tls13: "{{ ssl_cipher_suite_tls13 | default('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256') }}"
 # if using a self-signed certificate, set this to true to regenerate it
 horizon_ssl_self_signed_regen: false
 horizon_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ horizon_server_name }}/subjectAltName=IP.1={{ external_lb_vip_address }}"
diff --git a/releasenotes/notes/tls_variables-ab6684a5a5505068.yaml b/releasenotes/notes/tls_variables-ab6684a5a5505068.yaml
new file mode 100644
index 00000000..1a42d71e
--- /dev/null
+++ b/releasenotes/notes/tls_variables-ab6684a5a5505068.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    The variable 'horizon_ssl_cipher_suite' is deprecated in favour of
+    'horizon_ssl_cipher_suite_tls12' which will continue to manage
+    configuration of ciphers for TLS v1.2 and earlier.
diff --git a/templates/openstack_dashboard.conf.j2 b/templates/openstack_dashboard.conf.j2
index ca20eeab..194de591 100644
--- a/templates/openstack_dashboard.conf.j2
+++ b/templates/openstack_dashboard.conf.j2
@@ -30,7 +30,12 @@
     SSLCompression Off
     SSLProtocol {{ horizon_ssl_protocol }}
     SSLHonorCipherOrder On
-    SSLCipherSuite {{ horizon_ssl_cipher_suite }}
+    {% if horizon_ssl_cipher_suite_tls12 != "" -%}
+    SSLCipherSuite {{ horizon_ssl_cipher_suite_tls12 }}
+    {% endif -%}
+    {% if horizon_ssl_cipher_suite_tls13 != "" -%}
+    SSLCipherSuite TLSv1.3 {{ horizon_ssl_cipher_suite_tls13 }}
+    {% endif -%}
     SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
 {% endif %}
 {% if (horizon_enable_ssl | bool) and (horizon_external_ssl | bool) %}