diff --git a/include/ssl_key_handler.hpp b/include/ssl_key_handler.hpp
index 431dd84..c6ceb83 100644
--- a/include/ssl_key_handler.hpp
+++ b/include/ssl_key_handler.hpp
@@ -474,4 +474,65 @@
     }
     return mSslContext;
 }
+
+inline std::optional<boost::asio::ssl::context> getSSLClientContext()
+{
+    boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_client);
+
+    boost::system::error_code ec;
+
+    // Support only TLS v1.2 & v1.3
+    sslCtx.set_options(boost::asio::ssl::context::default_workarounds |
+                           boost::asio::ssl::context::no_sslv2 |
+                           boost::asio::ssl::context::no_sslv3 |
+                           boost::asio::ssl::context::single_dh_use |
+                           boost::asio::ssl::context::no_tlsv1 |
+                           boost::asio::ssl::context::no_tlsv1_1,
+                       ec);
+    if (ec)
+    {
+        BMCWEB_LOG_ERROR << "SSL context set_options failed";
+        return std::nullopt;
+    }
+
+    // Add a directory containing certificate authority files to be used
+    // for performing verification.
+    sslCtx.set_default_verify_paths(ec);
+    if (ec)
+    {
+        BMCWEB_LOG_ERROR << "SSL context set_default_verify failed";
+        return std::nullopt;
+    }
+
+    // Verify the remote server's certificate
+    sslCtx.set_verify_mode(boost::asio::ssl::verify_peer, ec);
+    if (ec)
+    {
+        BMCWEB_LOG_ERROR << "SSL context set_verify_mode failed";
+        return std::nullopt;
+    }
+
+    // All cipher suites are set as per OWASP datasheet.
+    // https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html
+    constexpr const char* sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:"
+                                       "ECDHE-RSA-AES128-GCM-SHA256:"
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384:"
+                                       "ECDHE-RSA-AES256-GCM-SHA384:"
+                                       "ECDHE-ECDSA-CHACHA20-POLY1305:"
+                                       "ECDHE-RSA-CHACHA20-POLY1305:"
+                                       "DHE-RSA-AES128-GCM-SHA256:"
+                                       "DHE-RSA-AES256-GCM-SHA384"
+                                       "TLS_AES_128_GCM_SHA256:"
+                                       "TLS_AES_256_GCM_SHA384:"
+                                       "TLS_CHACHA20_POLY1305_SHA256";
+
+    if (SSL_CTX_set_cipher_list(sslCtx.native_handle(), sslCiphers) != 1)
+    {
+        BMCWEB_LOG_ERROR << "SSL_CTX_set_cipher_list failed";
+        return std::nullopt;
+    }
+
+    return sslCtx;
+}
+
 } // namespace ensuressl