diff --git a/include/messages.h b/include/messages.h
index c5c399ef..f7806949 100644
--- a/include/messages.h
+++ b/include/messages.h
@@ -200,7 +200,7 @@
 #define NUMERIC_STR_517      "%s :This command has been administratively disabled"
 #define NUMERIC_STR_524      ":%s 524 %s %s :Help not found"
 #define NUMERIC_STR_670      ":STARTTLS successful, proceed with TLS handshake"
-#define NUMERIC_STR_671      "%s :is using a secure connection"
+#define NUMERIC_STR_671      "%s :%s"
 #define NUMERIC_STR_691      ":%s"
 #define NUMERIC_STR_702      ":%s 702 %s %s 0x%lx %s %s"
 #define NUMERIC_STR_703      ":%s 703 %s :End of /MODLIST."
diff --git a/modules/m_whois.c b/modules/m_whois.c
index a5515ed0..1fec2246 100644
--- a/modules/m_whois.c
+++ b/modules/m_whois.c
@@ -320,13 +320,20 @@ single_whois(struct Client *source_p, struct Client *target_p, int operspy)
 	}
 
 	if(IsSSLClient(target_p))
+	{
+		char cbuf[256] = "is using a secure connection";
+
+		if (MyClient(target_p) && target_p->localClient->cipher_string != NULL)
+			rb_snprintf_append(cbuf, sizeof(cbuf), " [%s]", target_p->localClient->cipher_string);
+
 		sendto_one_numeric(source_p, RPL_WHOISSECURE, form_str(RPL_WHOISSECURE),
-				   target_p->name);
-	if((source_p == target_p || IsOper(source_p)) &&
-			target_p->certfp != NULL)
-		sendto_one_numeric(source_p, RPL_WHOISCERTFP,
-				form_str(RPL_WHOISCERTFP),
-				target_p->name, target_p->certfp);
+				   target_p->name, cbuf);
+		if((source_p == target_p || IsOper(source_p)) &&
+				target_p->certfp != NULL)
+			sendto_one_numeric(source_p, RPL_WHOISCERTFP,
+					form_str(RPL_WHOISCERTFP),
+					target_p->name, target_p->certfp);
+	}
 
 	if(MyClient(target_p))
 	{