anchor.diff:  <%= partial '../opsguide/gorouter_client_cert_pcf' %>
   <% end %>
   
  -##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
  +##<a id="gorouter_term"></a>Terminating TLS at the Gorouter Only
   
   In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
   
  
positive.code: 
  The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%><span>:</span>
  
  * You must obtain at least one SSL/TLS certificate for your environment. 
    * In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
    * In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate. You can generate a self-signed certificate with `openssl` or a similar tool. 
    <%=vars.ssl_cert_ert%>
  * Certificates used in CF must be encoded in the PEM format. 
  * The Gorouter supports mutual TLS, and validates a client provided certificate chain against its CA certificates if one is provided in the TLS handshake, but does not require it. Depending on whether you choose to terminate at both the Load Balancer and the Gorouter, or at the Gorouter alone, the client certificate may be that of the load balancer or of the originating client.
  * The certificate on the Gorouter must be associated with the correct hostname so that HTTPS can validate the request.
  * If wildcard certificates are not supported for some or all of your domains, then configure termination requests at the [load balancer only](#lb_term). In this type of deployment, the load balancer passes unencrypted traffic to the Gorouter. As a result, you avoid having to reissue and reinstall certificates on the Gorouter for every app or UAA security zone.
  * Extended Validation (EV) certificates support multiple hostnames, like SAN, but do not support wildcards. As the Gorouter has not been tested with EV certificates, if EV certificates are required, then terminate TLS/SSL at the [load balancer only](#lb_term). 
  *  Given the dynamic and multi-tenant nature of <%=vars.product_short%>, use of wildcard domains is highly recommended to avoid the need for adding an additional certificate for each application.
  
  ## <a id="multcerts"></a> Multiple Certificates
  
negative.code: 
  ### <a id="http_header_lb_gorouter"></a> About HTTP Header Forwarding
  
  If you terminate TLS at your load balancer, then you must configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to requests it sends to the Gorouter.
  
  If you terminate TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. We recommend you use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in the Gorouter. As the `X-Forwarded-Proto` header will not be present, configure the Gorouter to force-set this header to 'HTTPS'. 
  
  For more information on HTTP headers in CF, see [HTTP Headers](../concepts/http-routing.html##http-headers). If you are configuring the forwarding of client certificates, see [Forward Client Certificate to Applications](../concepts/http-routing.html#forward-client-cert).
  
  