anchor.diff:  
   <%# HTTPS Frontend %>
   
  -<%
  -ssl_enabled = false
  -crt_config = ""
  -if_p("ha_proxy.ssl_pem") do
  -    ssl_enabled = true
  -    crt_config="crt /var/vcap/jobs/haproxy/config/ssl"
  -end
  -if_p("ha_proxy.crt_list") do
  -    if ssl_enabled == true
  -        abort("Conflicting configuration. Please configure either 'ssl_pem' OR 'crt_list', but not both")
  -    end
  -    ssl_enabled=true
  -    crt_config="crt-list /var/vcap/jobs/haproxy/config/ssl/crt-list"
  -end
  -%>
  -<% if ssl_enabled == true %>
  +<% if ssl_enabled == true -%>
  +# HTTPS Frontend
   frontend https-in
       mode http
  -    <% if p("ha_proxy.accept_proxy") %>
  -    bind <%= p("ha_proxy.binding_ip") %>:443 accept-proxy ssl <%= crt_config %> <% if p("ha_proxy.strict_sni") %> strict-sni <% end %>
  -    <% else %>
  -    bind <%= p("ha_proxy.binding_ip") %>:443 ssl <%= crt_config %> <% if p("ha_proxy.strict_sni") %> strict-sni <% end %> <% if p("ha_proxy.client_cert") == true -%>
  -      <%
  -        client_ca_certs = nil
  -        if_p("ha_proxy.client_ca_file") { client_ca_certs = "/var/vcap/jobs/haproxy/config/client-ca-certs.pem" }
  -        unless client_ca_certs
  -          client_ca_certs = "/etc/ssl/certs/ca-certificates.crt"
  -        end
  -      -%> ca-file <%= client_ca_certs %> verify optional <% if_p("ha_proxy.client_cert_ignore_err") do -%>
  -      crt-ignore-err <%= p("ha_proxy.client_cert_ignore_err")-%> <% end -%>
  -      <% if_p("ha_proxy.client_revocation_list") do -%>
  -        crl-file /var/vcap/jobs/haproxy/config/client-revocation-list.pem <% end -%>
  -      <% end -%>
  -    <% end %>
  -    <% if_p("ha_proxy.cidr_whitelist") do %>
  +    bind <%= p("ha_proxy.binding_ip") %>:443 <%= tls_bind_options %>
  +
  +    <% if_p("ha_proxy.cidr_whitelist") do -%>
       acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
       tcp-request content accept if whitelist
       <% end %>
  
positive.code: <% unless p("ha_proxy.disable_http") %>
  frontend http-in
      mode http
      bind <%= p("ha_proxy.binding_ip") %>:80
      <% if_p("ha_proxy.cidr_whitelist") do %>
      acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
      tcp-request content accept if whitelist
      <% end %>
  
negative.code: end
  %>
  
  <%
  if_p("ha_proxy.rsp_headers") do |rsp_headers|
    rsp_headers.each do |rsp_header, value|
  -%>
      rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  <%
    end
  end
  -%>
  
  <% if p("ha_proxy.internal_only_domains").size > 0 %>
      acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  