---
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/enabled
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/require_and_verify_client_certificates
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/trusted_ca_certificates
  value:
  - ((gorouter_backend_tls.ca))

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/verify_subject_alt_name
  value:
  - gorouter.service.cf.internal

---
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/enabled
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/require_and_verify_client_certificates
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/trusted_ca_certificates
  value:
  - ((service_cf_internal_ca.certificate))

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/verify_subject_alt_name
  value:
  - gorouter.service.cf.internal

Make route integrity Envoys trust CA cert, not cert CA
Make route integrity Envoys trust CA cert, not cert CA

Conform to the cf-deployment convention that services should verify other parties against the certificate(s) of a CA variable and not the certificate of the CA that issued a particular certificate.

[finishes #157607648](https://www.pivotaltracker.com/story/show/157607648)
