anchor.diff:  
   <%= image_tag("lb.png") %>
   
  -### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  -
  -You can use multiple certificates on your load balancer if the load balancer supports multiple VIPs or SNI.
  -
   ### <a id="http_header_lb"></a> About HTTP Header Forwarding
   
   If you terminate SSL/TLS at your load balancer, then you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  
positive.code: 
  Traffic between the load balancer and the Gorouter is encrypted only if the client request is encrypted.
  
  ### <a id="cert_guidelines_gorouter"></a>Certificate Guidelines
  
  * The Gorouter currently supports configuring multiple HTTPS certificates using the `router.tls_pem` property.
  * Use of Subject Alternative Names is recommended because <%=vars.product_short%> requires wildcard domains.
  
  ### <a id="http_header_gorouter"></a>About HTTP Header Forwarding
  
  If you terminate TLS/SSL at the Gorouter only, your load balancer does not send HTTP headers.
  
negative.code: * The certificate on the Gorouter must be associated with the correct hostname so that HTTPS can validate the request.
  * If wildcard certificates are not supported for some or all of your domains, then configure termination requests at the [load balancer only](#lb_term). In this type of deployment, the load balancer passes unencrypted traffic to the Gorouter. As a result, you avoid having to reissue and reinstall certificates on the Gorouter for every app or UAA security zone.
  * Extended Validation (EV) certificates support multiple hostnames, like SAN, but do not support wildcards. As Gorouter has not been tested with EV certificates, if EV certificates are required, then terminate TLS/SSL at the [load balancer only](#lb_term). 
  *  Given the dynamic and multi-tenant nature of <%=vars.product_short%>, use of wildcard domains is highly recommended to avoid the need for adding an additional certificate for each application.
  
  ## <a id="multcerts"></a> Multiple Certificates
  
  In order to support custom domains on CF, an operator
  has to configure the Gorouter with a certificate that represents the domain. It is recommended that operators add a new certificate instead of reissuing a single certificate when adding TLS support for an additional domain. Using multiple certificates provides a security benefit in that it prevents clients from discovering all the custom domains of applications running on a CF platform. 
  
  The Gorouter supports SNI and can be configured with multiple certificates, each which may optionally include wildcard and alternative names. Gorouter uses SNI to determine the correct certificate to present in a TLS handshake. It requires clients to support the SNI protocol by 
  sending a server name outside the encrypted request payload. 
  For clients that do not support SNI, Gorouter presents a default certificate. The default is the first certificate keypair in Gorouter's configuration.
  
  <%=vars.multiple_certs_gorouter%>
  
  <%=vars.multiple_certs_haproxy%>
  
  
  ## <a id="ciphers"></a> TLS Cipher Suite Support
  
  