diff --git a/main.go b/main.go
index 9b7ad66..d9c6f97 100644
--- a/main.go
+++ b/main.go
@@ -6,11 +6,13 @@ package main
 
 import (
 	"bufio"
+    "crypto/tls"
 	"crypto/sha256"
 	"database/sql"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
+    "flag"
 	"fmt"
 	"log"
 	"net"
@@ -122,6 +124,10 @@ func loadMOTD(filename string) error {
 	return nil
 }
 func main() {
+    tlsEnabled := flag.Bool("tls", false, "Enable TLS")
+    certFile := flag.String("cert", "", "TLS certificate file")
+    keyFile := flag.String("key", "", "TLS key file")
+    flag.Parse()
 	cfg, err := loadConfig()
 	if err != nil {
 		log.Fatalf("could not load config file: %v\n", err)
@@ -130,10 +136,28 @@ func main() {
 	if errmotd != nil {
 		log.Fatalf("could not load message of the day file: %v", err)
 	}
-	ln, err := net.Listen("tcp", fmt.Sprintf(":%d", cfg.Port))
-	if err != nil {
-		log.Fatalf("Error listening: %v\n", err)
-	}
+	var ln net.Listener
+    if *tlsEnabled {
+        if *certFile == "" || *keyFile == "" {
+            log.Fatalf("TLS enabled but cert/key not provided")
+        }
+        cert, err := tls.LoadX509KeyPair(*certFile, *keyFile)
+        if err != nil {
+            log.Fatalf("failed to load TLS cert/key: %v", err)
+        }
+        tlsCfg := &tls.Config{Certificates: []tls.Certificate{cert}}
+        ln, err = tls.Listen("tcp", fmt.Sprintf(":%d", cfg.Port), tlsCfg)
+        if err != nil {
+            log.Fatalf("Error listening with TLS: %v\n", err)
+        }
+        log.Printf("IRC server listening with TLS on port %d\n", cfg.Port)
+    } else {
+        ln, err = net.Listen("tcp", fmt.Sprintf(":%d", cfg.Port))
+        if err != nil {
+            log.Fatalf("Error listening: %v\n", err)
+        }
+        log.Printf("IRC server listening on port %d\n", cfg.Port)
+    }
 	sqlinitDB()
 	log.Printf("IRC server listening on port %d\n", cfg.Port)
 	go startHTTP(*cfg)