anchor.diff:        uaa\_token_url: <span>https</span>://uaa.YOUR-SYSTEM-DOMAIN/oauth/token
     </code></pre>
   
  -1. `ssh_proxy.host_key`: Supply the PEM-encoded private key from the RSA key pair that you originally generated for your deployment. This key secures the Application SSH proxy running in each container.
  +1. `ssh_proxy.host_key`: Supply the PEM-encoded private key from the RSA key pair that you originally generated for your deployment. This key secures the SSH proxy that brokers connections to individual app containers.
   1. Specify CF Authentication only by setting `enable_cf_auth` to `true` and `enable_diego_auth` to `false`, as in the example above.
   1. For `SSH-PROXY-SECRET`, enter the same secret you provided in the `ssh-proxy.secret` field in your Cloud Foundry manifest.
   1. To complete the `uaa_token_url` field, provide `YOUR-SYSTEM-DOMAIN`.
  
positive.code: <p class="note"><strong>Note</strong>: You should generate a unique key pair for each deployment.</p>
  
  1. Generate your key pair, entering an empty string for the passphrase when prompted.
  <pre class="terminal">$ ssh-keygen -f YOUR-DEPLOYMENT-DIRECTORY/keypair/ssh-proxy-host-key.pem
  $ ssh-keygen -lf YOUR-DEPLOYMENT-DIRECTORY/keypair/ssh-proxy-host-key.pem.pub | cut -d ' ' -f2 > YOUR-DEPLOYMENT-DIRECTORY/keypair/ssh-proxy-host-key-fingerprint
  </pre>
  1. Locate your PEM-encoded private key in `ssh-proxy-host-key.pem` and your public key fingerprint in `ssh-proxy-host-key-fingerprint`. You will need to copy the contents of these files into your Cloud Foundry and Diego manifests.
  
  ### <a id='cf-manifest'></a> Cloud Foundry Manifest
  
  Your manifest for Cloud Foundry, `cf-deployment.yml` should include the following properties:
  
    <pre><code>properties:
      app\_ssh:
  
negative.code: 
  1. Delete your `ssh-proxy` client.
  <pre class="terminal">$ uaac token client delete ssh-proxy</pre>
  
  ## <a id="troubleshooting"></a>Troubleshooting
  
  