anchor.diff:  The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%>
   
   * In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
  -* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool.
  +* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
   * The Gorouter currently only supports configuring a single HTTPS certificate. The certificate on the Gorouter must be associated with all the domains it may receive requests for so that HTTPS can validate the request. To associate multiple domains to a single certificate, including wildcard domains, use [Subject Alternative Name (SAN)](https://tools.ietf.org/html/rfc5280#section-4.2.1.6), an X.509 extension.
   * If wildcard certificates are not supported for some or all of your domains, then terminate TLS at your load balancer.
   * If you cannot use a SAN certificate, terminate TLS at your load balancer.
  
positive.code: 
  ### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  
  You can use multiple certificates on the load balancer if the load balancer supports multiple VIPs or SNI. Otherwise, use a SAN certificate.
  
  ### <a id="http_header_lb"></a> About HTTP Header Forwarding
  
  
negative.code: 
  To enable this configuration, you must perform the following steps:
  
  1. Add your certificates to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  1. Configure your load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` headers to client requests.
      * If the load balancer cannot be configured to provide the `X-Forwarded-For` header, the Gorouter appends it in requests forwarded to applications and system components, set to the IP address of the load balancer.
      <p class='note'><strong>Important:</strong> You must configure the load balancer to forward the `X-Forwarded-Proto` header. Otherwise requests to some applications and system components result in redirect loops, as requests determined to be unencrypted are redirected to HTTPS.
  
  
  