anchor.diff:  
   ### <a id="default"></a> Default Gorouter Cipher Suites
   
  -By default, the Gorouter supports the following TLS cipher suites, both of which require TLS v1.2:
  +By default, the Gorouter supports the following TLS cipher suites:
   
   <table>
     <tr>
  +    <th>TLS Version</th>
       <th>RFC</th>
       <th>OpenSSL</th>
     </tr>
     <tr>
  +    <td>1.2</td>
       <td>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</td>
       <td>ECDHE-RSA-AES128-GCM-SHA256</td>
     </tr>
     <tr>
  +    <td>1.2</td>
       <td>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</td>
       <td>ECDHE-RSA-AES256-GCM-SHA384</td>
     </tr>
  +  <tr>
  +    <td>1.3</td>
  +    <td>TLS_AES_128_GCM_SHA256</td>
  +    <td>TLS13-AES-128-GCM-SHA256</td>
  +  </tr>
  +  <tr>
  +    <td>1.3</td>
  +    <td>TLS_AES_256_GCM_SHA384</td>
  +    <td>TLS13-AES-256-GCM-SHA384</td>
  +  </tr>
  +  <tr>
  +    <td>1.3</td>
  +    <td>TLS_CHACHA20_POLY1305_SHA256</td>
  +    <td>TLS13-CHACHA20-POLY1305-SHA256</td>
  +  </tr>
   </table>
   
   <%= vars.cipher_suites %>
  
positive.code: - Configure Classic Load Balancer listeners in TCP mode. This allows TCP connections from clients to pass through the Classic Load Balancer to Gorouters on port `443`. With this configuration, Gorouters are the first point of TLS termination.
  
  - If you require TLS termination at an AWS load balancer in addition to terminating at the Gorouter, use [AWS Application Load Balancers (ALBs)](http://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) that support the Gorouter default cipher suites.
  
  ### <a id="tls_1.2"></a> TLS v1.2
  
  
negative.code: 
  * Given the dynamic and multi-tenant nature of <%= vars.app_runtime_abbr %>, use of wildcard domains is highly recommended to avoid the need for adding an additional certificate for each app.
  
  * To support TLS v1.3, ensure that you use certificates generated with a key larger than 512 bits. 
  
  
  ## <a id="multcerts"></a> Multiple Certificates
  
  