anchor.diff:    <td>
      Load Balancer and Gorouter
     </td>
  -  <td> <%=vars.ssl_lb_gorouter_link%>
  +  <td><a href="#lb_and_gorouter_term">Terminating SSL/TLS at the Load Balancer and Gorouter</a>
     </td>
     </tr>
   </tr>
  -
  -  
  -  </table>
  +</table>
        
   
   ## <a id="certtypes"></a> Certificate Requirements
  
positive.code: 
  ### <a id="pass-through"></a>Procedure: Gorouter Only
  
  To enable this configuration, perform the following steps:
  
  1. Configure your load balancer to pass through requests from the client to the Gorouter.
  1. Insert the certificate into your deployment manifest for the Gorouter:
      1. Use `bosh edit deployment` to open your release manifest for editing.
      1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field, and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  
          ```
          properties:
            router:
              ssl_cert: |
                -----BEGIN CERTIFICATE-----
                SSL_CERTIFICATE_SIGNED_BY_PRIVATE_KEY
                -----END CERTIFICATE-----
              ssl_key: |
                -----BEGIN RSA PRIVATE KEY-----
                RSA_PRIVATE_KEY
                -----END RSA PRIVATE KEY-----
              enable_ssl: true
          ```
  
  ##<a id="lb_and_gorouter_term"></a> Terminating SSL/TLS at the Load Balancer and Gorouter
  
  In this configuration two TLS connections are established: one from the client to the load balancer, and another from the load balancer to the Gorouter. This configuration secures all traffic between the load balancer and the Gorouter.
  
  
negative.code: 
  Traffic between the load balancer and the Gorouter is encrypted only if the client request is encrypted.
  
  ### <a id="cert_guidelines_gorouter"></a>Certificate Guidelines
  
  * The Gorouter currently only supports configuring a single HTTPS certificate.
  * Use a SAN certificate because <%=vars.product_short%> requires multiple wildcard domains.
  