anchor.diff:  
   * Extended Validation (EV) certificates support multiple hostnames, like SAN, but do not support wildcards. As the Gorouter has not been tested with EV certificates, if EV certificates are required, then terminate TLS at the load balancer only. 
   
  -* Given the dynamic and multi-tenant nature of <%= vars.app_runtime_abbr %>, use of wildcard domains is highly recommended to avoid the need for adding an additional certificate for each app.
  +* Given the dynamic and multi-tenant nature of <%= vars.app_runtime_abbr %>, <%= vars.recommended_by %> highly recommends using wildcard domains to avoid the need for adding an additional certificate for each app.
   
   * To support TLS v1.3, ensure that you use certificates generated with a key larger than 512 bits. 
   
  
positive.code: 
  In this configuration, your load balancer terminates TLS and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
  This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted between the load balancer and the Gorouter.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  
  
negative.code: * `router.sanitize_forwarded_proto: false` and `router.force_forwarded_proto_https: false`:<br>
  The Gorouter passes through the header as received from the load balancer, without modification.
  
  <p class='note'><strong>Note:</strong> If you configured TLS to terminate at the Gorouter only, <%= vars.recommended_by %> recommends setting <code>router.sanitize_forwarded_proto: true</code> and <code>router.force_forwarded_proto_https: false</code> is to secure against header spoofing.</p>
  
  For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of _HTTP Routing_.  For information about configuring the forwarding of client certificates, see the [Forward Client Certificate to Apps](../concepts/http-routing.html#forward-client-cert) section of _HTTP Routing_.
  
  