anchor.diff:  
   The first certificate listed acts as the default certificate. This has the equivalent behavior as the previous property `router.ssl_cert` and `router.ssl_key`.
   
  -When TLS is enabled in gorouter, the behavior is as follows:
  -
  -- If a client provides an SNI header with a ServerName that matches to a certificate in `router.tls_pem`, gorouter will return the matching certificate
  -- If a client provides an SNI header with a ServerName that does not match to a certificate in `router.tls_pem`, gorouter will return the default certificate
  -- If a client does not provide an SNI header and the requested hostname matches to a certificate in `router.tls_pem`, gorouter will return the matching certificate.
  -- If a client does not provide an SNI header and requested hostname does not match to a certificate in `router.tls_pem`, gorouter will return the default certificate.
  +When TLS is enabled in Gorouter, the behavior is as follows:
  +
  +- If a client provides an SNI header with a ServerName that matches to a certificate in `router.tls_pem`, Gorouter will return the matching certificate
  +- If a client provides an SNI header with a ServerName that does not match to a certificate in `router.tls_pem`, Gorouter will return the default certificate
  +- If a client does not provide an SNI header and the requested hostname matches to a certificate in `router.tls_pem`, Gorouter will return the matching certificate.
  +- If a client does not provide an SNI header and requested hostname does not match to a certificate in `router.tls_pem`, Gorouter will return the default certificate.
  
positive.code:     <ul>
        <li>You require TLS termination at a load balancer, and</li>
        <li>You want a higher level of security, and</li>
        <li>You do not mind a slightly less performant deployment</li>
    </td>
    <td>
     Load Balancer and Gorouter
  
negative.code: 
  If you terminate SSL/TLS at your load balancer, then you must configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to requests it sends to the Gorouter.
  
  If you terminate SSL/TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. We recommend you use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in Gorouter. As the `X-Forwarded-Proto` header will not be present, configure Gorouter to force-set this header to 'HTTPS'. 
  
  ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
  
  