anchor.diff:  
   ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
   
  -To enable this configuration, perform the following steps:
  -
  -1. Add your certificates to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  -1. Configure your load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` headers to client requests.
  -
  -    <br/>If the load balancer cannot be configured to provide the `X-Forwarded-For` header, the Gorouter will append it in requests forwarded to applications and system components, set to the IP address of the load balancer.
  -
  -    <p class='note'><strong>Note</strong>: If the load balancer accepts unencrypted requests, it <strong>must</strong> provide the X-Forwarded-Proto header. Conversely, if the load balancer cannot be configured to send the X-Forwarded-Proto header, it should not accept unencrypted requests. Otherwise, applications and platform system components that depend on the X-Forwarded-Proto header to reject unencrypted client requests will accept unencrypted requests.</p>
  -
  -1. Insert the certificate into your deployment manifest for the Gorouter:
  -    1. Use `bosh edit deployment` to open your release manifest for editing.
  -    1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field, and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  -
  -        ```
  -        properties:
  -          router:
  -            ssl_cert: |
  -              -----BEGIN CERTIFICATE-----
  -              SSL_CERTIFICATE_SIGNED_BY_PRIVATE_KEY
  -              -----END CERTIFICATE-----
  -            ssl_key: |
  -              -----BEGIN RSA PRIVATE KEY-----
  -              RSA_PRIVATE_KEY
  -              -----END RSA PRIVATE KEY-----
  -            enable_ssl: true
  -        ```
  -
  -##<a id="lb_term"></a> Terminating SSL/TLS at the Load Balancer Only
  -
  -In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  -
  -This option is recommended if you cannot use SAN certificates and you do not require traffic to be encrypted between the load balancer and the Gorouter. 
  -
  -The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  -
  -<%= image_tag("lb.png") %>
  -
  -### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  -
  -You can use multiple certificates on your load balancer if the load balancer supports multiple VIPs or SNI.
  -
  -### <a id="http_header_lb"></a> About HTTP Header Forwarding
  -
  -If you terminate SSL/TLS at your load balancer, then you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  -
  -### <a id="lb"></a> Procedure: Load Balancer Only
  -
  -To enable this configuration, you must perform the following steps:
  -
  -1. Add your certificates to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  -1. Configure your load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` headers to client requests.
  -    * If the load balancer cannot be configured to provide the `X-Forwarded-For` header, the Gorouter appends it in requests forwarded to applications and system components, set to the IP address of the load balancer.
  -    <p class='note'><strong>Important:</strong> You must configure the load balancer to forward the `X-Forwarded-Proto` header. Otherwise requests to some applications and system components result in redirect loops, as requests determined to be unencrypted are redirected to HTTPS.
  +<% if vars.product_name == 'CF' %>
  +<%= partial 'ssl_termin_gorouter_lb_oss' %>
  +<% else %>
  +<%= partial '../opsguide/ssl_termin_gorouter_lb_pcf' %>
  +<% end %>
   
   
  +
  
positive.code: 
  ### <a id="pass-through"></a>Procedure: Gorouter Only
  
  To enable this configuration, perform the following steps:
  
  1. Configure your load balancer to pass through requests from the client to the Gorouter.
  1. Insert the certificate into your deployment manifest for the Gorouter:
      1. Use `bosh edit deployment` to open your release manifest for editing.
      1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field, and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  
          ```
          properties:
            router:
              ssl_cert: |
                -----BEGIN CERTIFICATE-----
                SSL_CERTIFICATE_SIGNED_BY_PRIVATE_KEY
                -----END CERTIFICATE-----
              ssl_key: |
                -----BEGIN RSA PRIVATE KEY-----
                RSA_PRIVATE_KEY
                -----END RSA PRIVATE KEY-----
              enable_ssl: true
          ```
  
  ##<a id="lb_and_gorouter_term"></a> Terminating SSL/TLS at the Load Balancer and Gorouter
  
  In this configuration two TLS connections are established: one from the client to the load balancer, and another from the load balancer to the Gorouter. This configuration secures all traffic between the load balancer and the Gorouter.
  
  
negative.code: 
  Traffic between the load balancer and the Gorouter is encrypted only if the client request is encrypted.
  
  ### <a id="cert_guidelines_gorouter"></a>Certificate Guidelines
  
  * The Gorouter currently only supports configuring a single HTTPS certificate.
  * Use a SAN certificate because <%=vars.product_short%> requires multiple wildcard domains.
  