anchor.diff:  <%= image_tag("pass-through.png") %>
   
   Traffic between the load balancer and the Gorouter is encrypted only if the client request is encrypted.
  +
  +### <a id="cert_guidelines_gorouter"></a>Certificate Guidelines
  +
  +* The Gorouter currently supports configuring multiple HTTPS certificates using `router.tls_pem` property.
  +* Use a SAN certificate because <%=vars.product_short%> requires multiple wildcard domains.
   
   ### <a id="http_header_gorouter"></a>About HTTP Header Forwarding
   
  
positive.code:          vA==
           -----END CERTIFICATE-----
  ```
  The first certificate listed acts as the default certificate. This has the equivalent behavior as the previous property `router.ssl_cert` and `router.ssl_key`.
  
  When TLS is enabled in gorouter, the behavior is as follows:
  
negative.code: <%= partial '../opsguide/ssl_termin_gorouter_lb_pcf' %>
  <% end %>
  
  <<<<<<< ffe2faacd7b9b6cf99df17215695c2688dbcbb55
  ##<a id="lb_term"></a> Terminating SSL/TLS at the Load Balancer Only
  
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  