anchor.diff:  
   <%=vars.ssl_config%>
   
  -## <a id="protocol_support"></a> Protocol Support
  +## <a id="protocol_support"></a>Protocol Support
   
   Gorouter supports HTTP/HTTPS requests only. For more information on features supported by the Gorouter, see the [HTTP Routing](../concepts/http-routing.html) topic.
   
   To secure non-HTTP traffic, terminate TLS at your load balancer or at the application. See [TCP Routing](enabling-tcp-routing.html) for details.
   
  -##<a id="ssl_options"></a> SSL/TLS Termination Options
  +##<a id="ssl_options"></a>SSL/TLS Termination Options
   
   There are three options for terminating SSL/TLS for HTTP traffic. You can terminate TLS at the Gorouter, your load balancer, or at both. 
   
  
positive.code:   <td>
    Gorouter only
    </td>
    <td> <%=vars.ssl_gorouter_link%>
    </td>
    <tr>
    <td><ul><li>You cannot use a single SAN certificate for all system and application domains for your deployment, or</li>
  
negative.code: 
  ### <a id="pass-through"></a>Procedure: Gorouter Only
  
  <% if vars.product_name == 'CF' %>
  <%= partial 'ssl_termin_gorouter_oss' %>
  <% else %>
  <%= partial '../opsguide/ssl_termin_gorouter_pcf' %>
  <% end %>
  
  ##<a id="lb_term"></a> Terminating SSL/TLS at the Load Balancer Only
  
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
  This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted beetween the load balancer and the Gorouter. 
  
  The following diagram illustrates communication between the client, load balancer, Gorouter and app.
  
  <%= image_tag("lb.png") %>
  
  ### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  
  You can use multiple certificates on your load balancer if the load balancer supports multiple VIPs or SNI.
  
  ### <a id="http_header_lb"></a> About HTTP Header Forwarding
  
  If you terminate SSL/TLS at your load balancer, then you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  
  ### <a id="lb"></a> Procedure: Load Balancer Only
  
  <% if vars.product_name == 'CF' %>
  <%= partial 'ssl_termin_lb_only_oss' %>
  <% else %>
  <%= partial '../opsguide/ssl_termin_lb_only_pcf' %>
  <% end %>
  
  ##<a id="lb_and_gorouter_term"></a>Terminating SSL/TLS at the Load Balancer and Gorouter
  
  In this configuration two TLS connections are established: one from the client to the load balancer, and another from the load balancer to the Gorouter. This configuration secures all traffic between the load balancer and the Gorouter.
  
  