anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions. 
  +This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
   
   <%=vars.ssl_config%>
   
  
positive.code: 
  <%= image_tag("lb-and-router.png") %>
  
  This option is less performant, but it does allow for use of multiple certificates under certain circumstances. 
  
  ### <a id="cert_guidelines_lb_gorouter"></a> Certificate Guidelines
  
  In this deployment scenario, the following guidelines apply:
  
  - Certificates for the <%=vars.product_short%> domains must be stored on the load balancer.
  - On the Gorouter you can use a SAN certificate for all domains, or a standard certificate for a single domain that the load balancer has been configured to trust. In the latter case, however, you must disable hostname validation on the load balancer, as the domain of the certificate served by the Gorouter will not match requests sent to applications on <%=vars.product_short%>. 
  - If you are concerned about hosting a certificate key on the Gorouter, you can generate certificates for your load balancer for the same domains with a different key. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice versa.
  
  ### <a id="hostname_verfication"></a> About Hostname Verification 
  
  Hostname verification between the load balancer and Gorouter is unnecessary when the load balancer is already configured with the Gorouter's IP address to correctly route the request. 
  
  If the load balancer uses DNS resolution to route requests to the Gorouters, then you should enable hostname verification.
  
  
negative.code: 
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
  This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted between the load balancer and the Gorouter.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter and app.
  
  