anchor.diff:  
           % Get cert paths
           {ok, GrpCADir} = application:get_env(?APP_Name, grpca_dir),
  -        {ok, GrpKeyFile} = application:get_env(?APP_Name, grpkey_file),
  -        {ok, GrpCertFile} = application:get_env(?APP_Name, grpcert_file),
  +        {ok, GuiCaCertFile} = application:get_env(?APP_Name, gui_cacert_file),
  +        {ok, GuiCertFile} = application:get_env(?APP_Name, gui_cert_file),
  +        {ok, GuiKeyFile} = application:get_env(?APP_Name, gui_key_file),
  +
  +        {ok, GrpCABin} = file:read_file(grpca:cacert_path(GrpCADir)),
  +        [{_, GrpCADER, _} | _] = public_key:pem_decode(GrpCABin),
  +
  +        {ok, GuiCABin} = file:read_file(GuiCaCertFile),
  +        [{_, GuiCADER, _} | _] = public_key:pem_decode(GuiCABin),
   
           Dispatch = cowboy_router:compile([{'_', [{?op_channel_endpoint, op_channel_handler, []}]}]),
   
           {ok, _} = cowboy:start_https(?op_channel_listener, ProviderChannelHttpsAcceptors,
               [
                   {port, ProviderChannelPort},
  -                {cacertfile, grpca:cacert_path(GrpCADir)},
  -                {certfile, GrpCertFile},
  -                {keyfile, GrpKeyFile},
  -                {verify, verify_peer}
  +                % @todo Use gui cert files rather than certs generated by GR, since
  +                % we don't yet have a mechanism of distributing the CA cert.
  +                {certfile, GuiCertFile},
  +                {keyfile, GuiKeyFile},
  +                {cacerts, [GuiCADER, GrpCADER]},
  +                {verify, verify_peer},
  +                {ciphers, ssl:cipher_suites() -- weak_ciphers()},
  +                {versions, ['tlsv1.2', 'tlsv1.1']}
               ],
               [
                   {env, [{dispatch, Dispatch}]}
  
positive.code:         {ok, _} = cowboy:start_https(?rest_listener, RestHttpsAcceptors,
              [
                  {port, RestPort},
                  {cacertfile, grpca:cacert_path(GrpCADir)},
                  {certfile, GrpCertFile},
                  {keyfile, GrpKeyFile},
                  {verify, verify_peer}
              ],
              [
                  {env, [{dispatch, Dispatch}]}
  
negative.code:             ?error_stacktrace("Could not start gui, error: ~p", [Error]),
              {error, Error}
      end.
  
  
  %%--------------------------------------------------------------------
  %% @private
  