anchor.diff:  ### <a id="cert_guidelines_gorouter"></a> Certificate Guidelines
   
   * The Gorouter currently only supports configuring a single HTTPS certificate.
  -* The certificate on the Gorouter must be associated with the correct hostname so that HTTPS can validate the request.
   * Use a SAN certificate because <%=vars.product_short%> requires multiple wildcard domains.
   
   ### <a id="http_header_gorouter"></a>About HTTP Header Forwarding
   
   The Gorouter appends the `X-Forwarded-For` and `X-Forwarded-Proto` headers to requests forwarded to applications and platform system components. `X-Forwarded-For` is set to the IP address of the client, and `X-Forwarded-Proto` to the scheme of the client request.
   
  -If you terminate TLS/SSL at the Gorouter only, you do not need to configure any additional HTTP header forwarding.
  +If you terminate TLS/SSL at the Gorouter only, you do not need to configure any additional HTTP header forwarding on your load balancer.
   
   ### <a id="pass-through"></a>Procedure: Gorouter Only
   
  
positive.code: 
  To enable this configuration, you must perform the following steps:
  
  1. Configure your load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` headers to client requests.
      * If the load balancer cannot be configured to provide the `X-Forwarded-For` header, the Gorouter appends it in requests forwarded to applications and system components, set to the IP address of the load balancer.
      *  <strong>Important:</strong> Configure the load balancer to forward the `X-Forwarded-Proto` header. If you fail to configure this forwarding, requests to some applications and system components result in redirect loops, as some requests determined to be unencrypted are redirected to HTTPS.
  
  1. Add your certificate or certificates to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  
  
negative.code: The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%>
  
  * In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
  * In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
  * The Gorouter currently only supports configuring a single HTTPS certificate. The certificate on the Gorouter must be associated with all the domains it may receive requests for so that HTTPS can validate the request. To associate multiple domains to a single certificate, including wildcard domains, use [Subject Alternative Name (SAN)](https://tools.ietf.org/html/rfc5280#section-4.2.1.6), an X.509 extension.
  * If wildcard certificates are not supported for some or all of your domains, then terminate TLS at your load balancer.
  * If you cannot use a SAN certificate, terminate TLS at your load balancer.
  