diff --git a/Source/MQTTnet/Client/MqttClientOptionsBuilder.cs b/Source/MQTTnet/Client/MqttClientOptionsBuilder.cs
index 4948ad37..77c61bd3 100644
--- a/Source/MQTTnet/Client/MqttClientOptionsBuilder.cs
+++ b/Source/MQTTnet/Client/MqttClientOptionsBuilder.cs
@@ -1,5 +1,8 @@
 using System;
 using System.Linq;
+using System.Net.Security;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
 using MQTTnet.Serializer;
 
 namespace MQTTnet.Client
@@ -113,7 +116,9 @@ namespace MQTTnet.Client
             bool allowUntrustedCertificates = false,
             bool ignoreCertificateChainErrors = false,
             bool ignoreCertificateRevocationErrors = false,
-            params byte[][] certificates)
+            byte[][] certificates = null,
+            SslProtocols sslProtocol = SslProtocols.Tls12,
+            Func<X509Certificate, X509Chain, SslPolicyErrors, IMqttClientOptions, bool> certificateValidationCallback = null)
         {
             _tlsOptions = new MqttClientTlsOptions
             {
@@ -121,7 +126,9 @@ namespace MQTTnet.Client
                 AllowUntrustedCertificates = allowUntrustedCertificates,
                 IgnoreCertificateChainErrors = ignoreCertificateChainErrors,
                 IgnoreCertificateRevocationErrors = ignoreCertificateRevocationErrors,
-                Certificates = certificates?.ToList()
+                Certificates = certificates?.ToList(),
+                SslProtocol = sslProtocol,
+                CertificateValidationCallback = certificateValidationCallback
             };
 
             return this;
diff --git a/Source/MQTTnet/Client/MqttClientTlsOptions.cs b/Source/MQTTnet/Client/MqttClientTlsOptions.cs
index 2536b231..73d65cbc 100644
--- a/Source/MQTTnet/Client/MqttClientTlsOptions.cs
+++ b/Source/MQTTnet/Client/MqttClientTlsOptions.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Net.Security;
 using System.Security.Cryptography.X509Certificates;
+using System.Security.Authentication;
 
 namespace MQTTnet.Client
 {
@@ -17,6 +18,8 @@ namespace MQTTnet.Client
 
         public List<byte[]> Certificates { get; set; }
 
+        public SslProtocols SslProtocol { get; set; } = SslProtocols.Tls12;
+
         public Func<X509Certificate, X509Chain, SslPolicyErrors, IMqttClientOptions, bool> CertificateValidationCallback { get; set; }
     }
 }
diff --git a/Source/MQTTnet/Implementations/MqttTcpChannel.cs b/Source/MQTTnet/Implementations/MqttTcpChannel.cs
index c48a06f6..d7c55a77 100644
--- a/Source/MQTTnet/Implementations/MqttTcpChannel.cs
+++ b/Source/MQTTnet/Implementations/MqttTcpChannel.cs
@@ -63,7 +63,7 @@ namespace MQTTnet.Implementations
             if (_options.TlsOptions.UseTls)
             {
                 sslStream = new SslStream(new NetworkStream(_socket, true), false, InternalUserCertificateValidationCallback);
-                await sslStream.AuthenticateAsClientAsync(_options.Server, LoadCertificates(), SslProtocols.Tls12, _options.TlsOptions.IgnoreCertificateRevocationErrors).ConfigureAwait(false);
+                await sslStream.AuthenticateAsClientAsync(_options.Server, LoadCertificates(), _options.TlsOptions.SslProtocol, _options.TlsOptions.IgnoreCertificateRevocationErrors).ConfigureAwait(false);
             }
 
             CreateStream(sslStream);