anchor.diff:  <%= partial '../console/xfcc_router' %>
   <% end %>
   
  -## <a id="client-side-tls"></a>Client-Side TLS
  +## <a id="client-side-tls"></a> Client-Side TLS
   
   Depending on your needs, you can configure your deployment to terminate TLS at the Gorouter, at the Gorouter and the load balancer, or at the load balancer only. <%= vars.http_routing %>
   
  
positive.code: 
  ### <a id="config-by-instance-group"></a> Consistency Mode Can Differ by Instance Group
  
  The Gorouter can [validate app instance identity using TLS](#with-tls) only when Diego cells are configured appropriately. Because cells are configured for TLS through the instance group that they belong to, the Gorouter can run in different consistency modes with cells in different instance groups. For example, the Gorouter can communicate over TLS and validate the cells in one Isolation Segment, while communicating with cells in another Isolation Segment via plain text and [without validating instance identity](#without-tls).
  
  Currently, only Linux cells support the Gorouter validating app instance identities [using TLS](#with-tls). With Windows cells, the Gorouter runs [without TLS enabled](#without-tls), forwarding requests to Windows apps over plain text and pruning based on route TTL.
  
  <% end %>
  
  
negative.code: The Gorouter does not automatically initiate TLS handshakes with back end destinations. To register that the Gorouter must initiate a TLS handshake before forwarding HTTP requests to a component, the component must include the following optional fields in its `route.register` message to NATS:
  
  - `"tls_port"`: The port to which the Gorouter should open a connection and initiate a TLS handshake
  - `"server_cert_domain_san"`: An identifier for the back end which the Gorouter expects to find in the Domain Subject Alternative Name of the certificate presented by the back end. This is used to prevent misrouting for back ends whose IPs and/or ports are expected to change. For more information, see [Consistency](#consistency).
  
  To enable TLS from the Gorouter to application instances, some additional configuration is required in addition to the properties above. For more information, see [Configuring Consistency with TLS](#with-tls).
  
  Authors of routable components can configure Route Registrar to send the necessary NATS message automatically. For more information, see the [route-registrar](https://github.com/cloudfoundry/route-registrar) repository on GitHub.
  
  To enable mutual authentication between the Gorouter and back ends, operators configure the Gorouter with a certificate and private key using the following manifest properties:
  
  