anchor.diff:  - `"tls_port"`: The port to which Gorouter should open a connection and initiate a TLS handshake
   - `"server_cert_domain_san"`: An identifier for the back end which Gorouter expects to find in the Domain Subject Alternative Name of the certificate presented by the back end. This is used to prevent misrouting for back ends whose IPs and/or ports are expected to change; see [Consistency](#consistency).
   
  -To enable TLS from Gorouter to application instances, some additional configuration is required in addition to the properties above; see [Configuring Consistency with TLS](#consistency-with-tls).
  +To enable TLS from Gorouter to application instances, some additional configuration is required in addition to the properties above; see [Configuring Consistency with TLS](#with-tls).
   
   Authors of routable components can configure [Route Registrar](https://github.com/cloudfoundry/route-registrar) to send the necessary NATS message automatically.
   
  
positive.code: <%= partial '../console/router_app_tls_pcf' %>
  <% end %>
  
  ### <a id="consistency-without-tls"></a>Without TLS Enabled
  
  In this mode, the Diego Route Emitters on each cell send route registration messages that include instructions for Gorouter to send unencrypted requests to the app instance. If Gorouter does not receive an update for the route within the time-to-live (TTL) interval, the route is pruned from Gorouter's routing table. See [TLS to Apps and Other Back-End Services](#tls-to-back-end) for details.
  
  This pruning method was developed before the alternative was available.
  
  <% if vars.product_name.include? "CF" %>
  
  ### <a id="config-by-instance-group"></a>Consistency Behavior can vary by Instance Group
  
  Gorouter can [validate app instance identity using TLS](#consistency-with-tls) only when Diego Cells are configured appropriately. As this configuration is scoped to an instance group of Cells, some Cells (such as in an [Isolation Segment](../adminguide/isolation-segments.html)) can be configured to receive TLS requests from Gorouter and others plain text [without validation of instance identity](#without-tls). This behavior can be
  
  Validation of app instance identity using TLS is supported for Linux Cells only. Support for Windows Cells may be added later. Gorouter forwards requests to Windows apps over plain text and prunes based on route TTL.
  
  <% end %>
  
  
negative.code:   </tr>
  </table>
  
  Both of these consistency modes are described below.
  
  ### <a id="with-tls"></a>With TLS Enabled
  
  This consistency mode is newer and has the following benefits:
  
  - Improved availability for applications by keeping routes in Gorouters routing table when TTL expires
  - Increased guarantees against misrouting, by validating the identity of back ends before forwarding requests
  