anchor.diff:  
   If you terminate TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. You should use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in the Gorouter. As the `X-Forwarded-Proto` header is stripped, configure the Gorouter to force-set this header to 'HTTPS'. 
   
  -For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of the _HTTP Routing_ topic. If you are configuring the forwarding of client certificates, see the [Forward Client Certificate to Applications](../concepts/http-routing.html#forward-client-cert) section of the _HTTP Routing_ topic.
  +For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of the _HTTP Routing_ topic. If you are configuring the forwarding of client certificates, see the [Forward Client Certificate to Apps](../concepts/http-routing.html#forward-client-cert) section of the _HTTP Routing_ topic.
   
   ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
   
  
positive.code: 
  The Gorouter decides which certificate to provide in the TLS handshake as follows:
  
  - If a client provides an SNI header with a ServerName that matches to a configured certificate keypair, the Gorouter returns the matching certificate.
  - If a client provides an SNI header with a ServerName that does not match a configured certificate keypair, the Gorouter returns the default certificate.
  
  The first certificate keypair listed is used as the default. 
  
  The Gorouter supports both RSA and ECDSA certificates in PEM encoding. In the case that a certificate chain is required, the order should be as follows: primary certificate, intermediate certificate, then root certificate.
  
  
  ### <a id="how-to-config-mult-certs"></a> How to Configure Multiple Certificate Keypairs
  
  
negative.code: 
  You cannot configure cipher suites for TLS v1.3. Gorouter only supports the defaults listed in [Default Gorouter Cipher Suites](#default). 
  
  <p class="note"><strong>Note:</strong> To support TLS v1.3, ensure the Gorouter is configured with certificates generated with a key larger than 512 bits.</p>
  
  ### <a id="tls_1.2"></a> TLS v1.2
  
  