diff --git a/Database/PostgreSQL/Typed/Protocol.hs b/Database/PostgreSQL/Typed/Protocol.hs
--- a/Database/PostgreSQL/Typed/Protocol.hs
+++ b/Database/PostgreSQL/Typed/Protocol.hs
@@ -186,12 +186,13 @@
   , pgDBLogMessage :: MessageFields -> IO () -- ^ How to log server notice messages (e.g., @print . PGError@)
 #ifdef VERSION_tls
   , pgDBTLS :: PGTlsMode -- ^ TLS mode
+  , pgDBTLSParams :: Maybe TLS.ClientParams -- ^ TLS client params
 #endif
   } deriving (Show)
 
 instance Eq PGDatabase where
 #ifdef VERSION_tls
-  PGDatabase a1 n1 u1 p1 l1 _ _ s1 == PGDatabase a2 n2 u2 p2 l2 _ _ s2 =
+  PGDatabase a1 n1 u1 p1 l1 _ _ s1 _ == PGDatabase a2 n2 u2 p2 l2 _ _ s2 _ =
     a1 == a2 && n1 == n2 && u1 == u2 && p1 == p2 && l1 == l2 && s1 == s2
 #else
   PGDatabase a1 n1 u1 p1 l1 _ _ == PGDatabase a2 n2 u2 p2 l2 _ _ =
@@ -394,6 +395,7 @@
   , pgDBLogMessage = defaultLogMessage
 #ifdef VERSION_tls
   , pgDBTLS = TlsDisabled
+  , pgDBTLSParams = Nothing
 #endif
   }
 
@@ -754,12 +756,20 @@
           pure $ PGTlsContext ctx
         "N" -> throwIO (userError "Server does not support TLS")
         _ -> throwIO (userError "Unexpected response from server when issuing SSLRequest")
-    params = (TLS.defaultParamsClient tlsHost tlsPort)
-      { TLS.clientSupported =
-          def { TLS.supportedCiphers = TLS.ciphersuite_strong }
-      , TLS.clientShared = clientShared
-      , TLS.clientHooks = clientHooks
-      }
+    params = 
+      case pgDBTLSParams db of
+        Nothing -> (TLS.defaultParamsClient tlsHost tlsPort)
+          { TLS.clientSupported =
+              def 
+                  { TLS.supportedCiphers = TLS.ciphersuite_strong
+#if MIN_VERSION_tls(2,0,0)
+                  , TLS.supportedExtendedMainSecret = TLS.AllowEMS 
+#endif
+                  }
+          , TLS.clientShared = clientShared
+          , TLS.clientHooks = clientHooks
+          }
+        Just userParams -> userParams { TLS.clientShared = clientShared, TLS.clientHooks = clientHooks }
     tlsHost = case pgDBAddr db of
       Left (h,_) -> h
       Right (Net.SockAddrUnix s) -> s
diff --git a/postgresql-typed.cabal b/postgresql-typed.cabal
--- a/postgresql-typed.cabal
+++ b/postgresql-typed.cabal
@@ -1,5 +1,5 @@
 Name:          postgresql-typed
-Version:       0.6.2.5
+Version:       0.6.2.6
 Cabal-Version: >= 1.10
 License:       BSD3
 License-File:  COPYING
@@ -25,7 +25,7 @@
 
 source-repository head
   type:     git
-  location: git://github.com/dylex/postgresql-typed
+  location: https://github.com/dylex/postgresql-typed
 
 Flag md5
   Description: Enable md5 password authentication method.
@@ -62,6 +62,10 @@
   Description: Use crypton rather than cryptonite.
   Default: True
 
+Flag ram
+  Description: Use ram rather than memory (only if crypton).
+  Default: False
+
 Library
   default-language:    Haskell2010
   Build-Depends:
@@ -97,11 +101,16 @@
     Database.PostgreSQL.Typed.TypeCache
   GHC-Options: -Wall
   if flag(md5)
-    Build-Depends: memory >= 0.5
     if flag(crypton)
-      Build-Depends: crypton
+      if flag(ram)
+        Build-Depends: crypton >= 1.1
+        Build-Depends: ram
+      else
+        Build-Depends: crypton < 1.1
+        Build-Depends: memory >= 0.5
     else
       Build-Depends: cryptonite >= 0.5
+      Build-Depends: memory >= 0.5
   if flag(binary)
     Build-Depends: postgresql-binary >= 0.8, text >= 1, uuid >= 1.3, scientific >= 0.3
   else