diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
index a9df6c8a09..cb5abd2057 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
@@ -306,6 +306,11 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
 		 */
 		private String protocolHeader;
 
+		/**
+		 * Value of the protocol header that indicates that the incoming request uses SSL.
+		 */
+		private String protocolHeaderHttpsValue = "https";
+
 		/**
 		 * Name of the HTTP header used to override the original port value.
 		 */
@@ -435,6 +440,14 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
 			this.protocolHeader = protocolHeader;
 		}
 
+		public String getProtocolHeaderHttpsValue() {
+			return this.protocolHeaderHttpsValue;
+		}
+
+		public void setProtocolHeaderHttpsValue(String protocolHeaderHttpsValue) {
+			this.protocolHeaderHttpsValue = protocolHeaderHttpsValue;
+		}
+
 		public String getPortHeader() {
 			return this.portHeader;
 		}
@@ -502,6 +515,7 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
 				valve.setProtocolHeader(protocolHeader);
 				valve.setInternalProxies(getInternalProxies());
 				valve.setPortHeader(getPortHeader());
+				valve.setProtocolHeaderHttpsValue(getProtocolHeaderHttpsValue());
 				factory.addContextValves(valve);
 			}
 		}
diff --git a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java
index f7eb8449ea..e0a0023132 100644
--- a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java
+++ b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java
@@ -192,6 +192,7 @@ public class ServerPropertiesTests {
 		assertThat(valve, instanceOf(RemoteIpValve.class));
 		RemoteIpValve remoteIpValve = (RemoteIpValve) valve;
 		assertEquals("x-forwarded-proto", remoteIpValve.getProtocolHeader());
+		assertEquals("https", remoteIpValve.getProtocolHeaderHttpsValue());
 		assertEquals("x-forwarded-for", remoteIpValve.getRemoteIpHeader());
 
 		String expectedInternalProxies = "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|" // 10/8
@@ -212,6 +213,7 @@ public class ServerPropertiesTests {
 		map.put("server.tomcat.protocol_header", "x-my-protocol-header");
 		map.put("server.tomcat.internal_proxies", "192.168.0.1");
 		map.put("server.tomcat.port-header", "x-my-forward-port");
+		map.put("server.tomcat.protocol-header-https-value", "On");
 		bindProperties(map);
 
 		TomcatEmbeddedServletContainerFactory container = new TomcatEmbeddedServletContainerFactory();
@@ -222,6 +224,7 @@ public class ServerPropertiesTests {
 		assertThat(valve, instanceOf(RemoteIpValve.class));
 		RemoteIpValve remoteIpValve = (RemoteIpValve) valve;
 		assertEquals("x-my-protocol-header", remoteIpValve.getProtocolHeader());
+		assertEquals("On", remoteIpValve.getProtocolHeaderHttpsValue());
 		assertEquals("x-my-remote-ip-header", remoteIpValve.getRemoteIpHeader());
 		assertEquals("x-my-forward-port", remoteIpValve.getPortHeader());
 		assertEquals("192.168.0.1", remoteIpValve.getInternalProxies());
diff --git a/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc b/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
index 0fae679d16..6395486b44 100644
--- a/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
+++ b/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
@@ -99,6 +99,7 @@ content into your application; rather pick only the properties that you need.
 			172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|\\
 			172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3} # regular expression matching trusted IP addresses
 	server.tomcat.protocol-header=x-forwarded-proto # front end proxy forward header
+	server.tomcat.protocol-header-https-value=https # value of the protocol header that indicates that the incoming request uses SSL
 	server.tomcat.port-header= # front end proxy port header
 	server.tomcat.remote-ip-header=x-forwarded-for
 	server.tomcat.basedir=/tmp # base dir (usually not needed, defaults to tmp)