anchor.diff:  ##<a id="lb"></a> Terminate TLS at Load Balancer Only
   <%= image_tag("lb.png") %>
   
  -In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the router, which routes it to your app. To enable this configuration, you must perform the following steps:
  +In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the router, which routes it to your app. Traffic between the load balancer and the router is not encrypted.
   
  -1. Configure your load balancer to append the X-Forwarded-For and X-Forwarded-Proto headers to client requests. If it does not, the router sets the X-Forwarded-For header to the IP address of the load balancer, and the X-Forwarded-Proto to the scheme of the HTTP request from the load balancer.
  +To enable this configuration, you must perform the following steps:
  +
  +1. Configure your load balancer to append the X-Forwarded-For and X-Forwarded-Proto headers to client requests. If it does not, the router sets the X-Forwarded-For header to the IP address of the load balancer, and X-Forwarded-Proto to HTTPS, which is the scheme of the request from the load balancer.
   1. Add your certificate to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  
positive.code: <%= image_tag("pass-through.png") %>
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the router. This is the more performant option, establishing and terminating a single TLS connection. The certificate on the router must be associated with the correct hostname so that HTTPS can validate the request, and signed by a trusted CA.
  
  To enable this configuration, perform the following steps:
  
  
negative.code: 
  In this configuration, CF establishes and terminates two TLS connections: one from the client to the load balancer, and another from the load balancer to the CF router. This option is less performant, but it does allow for multiple certificates to be used, meaning multiple domains can be verified when using HTTPS. Certificates for the CF domains must be stored on the load balancer and, if hostname validation is enabled, on the CF router (using a single certificate). The certificate on the CF router only needs to be trusted by the load balancer, and the domain does not need to match the request as long as hostname verification is not enabled on the load balancer.
  
  This configuration secures all traffic between the load balancer and the router. 
  
  <p class="note"><strong>Note</strong>: If your CF deployment uses a self-signed certificate, the client needs to install only the certificate stored on the load balancer.</p> 
  
  To enable this configuration, perform the following steps:
  
  1. Add your certificate to your load balancer and configure its listening port. The procedures vary depending on your IaaS. 
  1. Configure your load balancer to append the X-Forwarded-For and X-Forwarded-Proto headers to client requests. If it does not, the router sets the X-Forwarded-For header to the IP address of the load balancer, and X-Forwarded-Proto to HTTPS, which is the scheme of the request from the load balancer.
  1. Insert the certificate into your deployment manifest for the CF router:
  	1. Use `bosh edit deployment` to open your release manifest for editing.
  	1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  