anchor.diff:                  {port, GuiPort},
                   {cacertfile, GuiCaCertFile},
                   {certfile, GuiCertFile},
  -                {keyfile, GuiKeyFile}
  +                {keyfile, GuiKeyFile},
  +                {ciphers, ssl:cipher_suites() -- weak_ciphers()},
  +                {versions, ['tlsv1.2', 'tlsv1.1']}
               ],
               [
                   {env, [{dispatch, cowboy_router:compile(GUIDispatch)}]},
  
positive.code:         {ok, _} = cowboy:start_https(?rest_listener, RestHttpsAcceptors,
              [
                  {port, RestPort},
                  {cacertfile, grpca:cacert_path(GrpCADir)},
                  {certfile, GrpCertFile},
                  {keyfile, GrpKeyFile},
                  {verify, verify_peer}
              ],
              [
                  {env, [{dispatch, Dispatch}]}
  
negative.code: 
          % Get cert paths
          {ok, GrpCADir} = application:get_env(?APP_Name, grpca_dir),
          {ok, GuiCaCertFile} = application:get_env(?APP_Name, gui_cacert_file),
          {ok, GuiCertFile} = application:get_env(?APP_Name, gui_cert_file),
          {ok, GuiKeyFile} = application:get_env(?APP_Name, gui_key_file),
  
          {ok, GrpCABin} = file:read_file(grpca:cacert_path(GrpCADir)),
          [{_, GrpCADER, _} | _] = public_key:pem_decode(GrpCABin),
  
          {ok, GuiCABin} = file:read_file(GuiCaCertFile),
          [{_, GuiCADER, _} | _] = public_key:pem_decode(GuiCABin),
  
          Dispatch = cowboy_router:compile([{'_', [{?op_channel_endpoint, op_channel_handler, []}]}]),
  
          {ok, _} = cowboy:start_https(?op_channel_listener, ProviderChannelHttpsAcceptors,
              [
                  {port, ProviderChannelPort},
                  % @todo Use gui cert files rather than certs generated by GR, since
                  % we don't yet have a mechanism of distributing the CA cert.
                  {certfile, GuiCertFile},
                  {keyfile, GuiKeyFile},
                  {cacerts, [GuiCADER, GrpCADER]},
                  {verify, verify_peer},
                  {ciphers, ssl:cipher_suites() -- weak_ciphers()},
                  {versions, ['tlsv1.2', 'tlsv1.1']}
              ],
              [
                  {env, [{dispatch, Dispatch}]}
  