anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions. 
  +This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
   
   <%=vars.ssl_config%>
   
  
positive.code: 
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
  This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted between the load balancer and the Gorouter. 
  
  The following diagram illustrates communication between the client, load balancer, Gorouter and app.
  
  
negative.code: 
  ## <a id="ciphers"></a> Cipher Suites
  
  By default Gorouter supports the following cipher suites, both of which require TLSv1.2:
  
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  
  The following cipher suites are optionally supported for TLS1.2 only:
  
      TLS_RSA_WITH_AES_128_CBC_SHA256
      TLS_RSA_WITH_AES_128_GCM_SHA256
      TLS_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_RSA_WITH_RC4_128_SHA
      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
  
  The following cipher suites are optionally supported for TLS1.0 and 1.2 only:
  
      TLS_RSA_WITH_RC4_128_SHA
      TLS_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_RSA_WITH_AES_128_CBC_SHA
      TLS_RSA_WITH_AES_256_CBC_SHA
  
  <%= vars.cipher_suites %>
  
  See [Golang Constants](https://golang.org/pkg/crypto/tls/#pkg-constants) and [OpenSSL Cipher Suites](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html) for more information about supported ciphers.
  
  <p class="note"><strong>Note</strong>: ECDSA ciphers require a certificate and key for DSA, as opposed to RSA.</p>
  
  ##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
  
  This option is the recommended and more performant option, establishing and terminating a single TLS connection.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  
  