anchor.diff:  The Gorouter does not automatically initiate TLS handshakes with back end destinations. To register that the Gorouter must initiate a TLS handshake before forwarding HTTP requests to a component, the component must include the following optional fields in its `route.register` message to NATS:
   
   - `"tls_port"`: The port to which the Gorouter should open a connection and initiate a TLS handshake
  -- `"server_cert_domain_san"`: An identifier for the back end which the Gorouter expects to find in the Domain Subject Alternative Name of the certificate presented by the back end. This is used to prevent misrouting for back ends whose IPs and/or ports are expected to change; see [Consistency](#consistency).
  -
  -To enable TLS from the Gorouter to application instances, some additional configuration is required in addition to the properties above; see [Configuring Consistency with TLS](#with-tls).
  -
  -Authors of routable components can configure [Route Registrar](https://github.com/cloudfoundry/route-registrar) to send the necessary NATS message automatically.
  +- `"server_cert_domain_san"`: An identifier for the back end which the Gorouter expects to find in the Domain Subject Alternative Name of the certificate presented by the back end. This is used to prevent misrouting for back ends whose IPs and/or ports are expected to change. For more information, see [Consistency](#consistency).
  +
  +To enable TLS from the Gorouter to application instances, some additional configuration is required in addition to the properties above. For more information, see [Configuring Consistency with TLS](#with-tls).
  +
  +Authors of routable components can configure Route Registrar to send the necessary NATS message automatically. For more information, see the [route-registrar](https://github.com/cloudfoundry/route-registrar) repository on GitHub.
   
   To enable mutual authentication between the Gorouter and back ends, operators configure the Gorouter with a certificate and private key using the following manifest properties:
   
  
positive.code: 
  If keepalive connections are disabled, the Gorouter closes the TCP connection with an app instance or system component after receiving an HTTP response.
  
  If keepalive connections are enabled, the Gorouter maintains established TCP connections to back ends. the Gorouter supports up to 100 idle connections to each back end:
  
  * If an idle connection exists for a given back end, the Gorouter reuses it to route subsequent requests.
  * If no idle connection exists for this back end, the Gorouter creates a new connection.
  
negative.code:     <td>returns an error to the client, marks backend ineligible, and does not retry another backend</td>
  </table>
  
  In all cases, if the app still does not respond to the request, the Gorouter returns a .`502` error. For more information, see [Troubleshooting Router Error Responses](https://docs.cloudfoundry.org/adminguide/troubleshooting-router-error-responses.html).
  