anchor.diff:  <%= partial '../opsguide/ssl_termin_gorouter_lb_pcf' %>
   <% end %>
   
  +<<<<<<< ffe2faacd7b9b6cf99df17215695c2688dbcbb55
   ##<a id="lb_term"></a> Terminating SSL/TLS at the Load Balancer Only
   
   In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
positive.code: The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%><span>:</span>
  
  * In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
  * In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
  * If you must terminate TLS at your load balancer, you may optionally secure requests from the load balancer to the Gorouter by terminating TLS at the Gorouter also. To accomplish this configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.
  * The Gorouter supports SNI and can be configured with multiple certificates, each which may optionally include wildcard and alternative names.
  * The Gorouter supports mutual TLS; the Gorouter will validate a client provided certificate chain against its CA certificates if one is provided in the TLS handshake, but does not require it. Depending on whether you choose to terminate at both the load balancer and Gorouter, or at Gorouter alone, the client certificate may that of the load balancer or of the originating client.
  
  ## <a id="ciphers"></a> Cipher Suites
  
  
negative.code:          vA==
           -----END CERTIFICATE-----
  ```
  
  The first certificate listed acts as the default certificate. This has the equivalent behavior as the previous property `router.ssl_cert` and `router.ssl_key`.
  
  When TLS is enabled in gorouter, the behavior is as follows:
  