anchor.diff:  
   In this deployment scenario, the following guidelines apply:
   
  -- Certificates for the <%=vars.product_short%> domains must be stored on the load balancer, as well as on the Gorouter.
  +- Certificates for the <%= vars.app_runtime_abbr %> domains must be stored on the load balancer, as well as on the Gorouter.
   
   - Generate certificates for your load balancer and the Gorouter with different keys. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice-versa.
   
  
positive.code: 
  If you terminate TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. You should use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in the Gorouter. As the `X-Forwarded-Proto` header is stripped, configure the Gorouter to force-set this header to 'HTTPS'. 
  
  For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of the _HTTP Routing_ topic. If you are configuring the forwarding of client certificates, see the [Forward Client Certificate to Applications](../concepts/http-routing.html#forward-client-cert) section of the _HTTP Routing_ topic.
  
  ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
  
  
negative.code: 
  The Gorouter decides which certificate to provide in the TLS handshake as follows:
  
  * If a client provides an SNI header with a ServerName that matches to a configured certificate keypair, the Gorouter returns the matching certificate.
  
  * If a client provides an SNI header with a ServerName that does not match a configured certificate keypair, the Gorouter returns the default certificate.
  
  The first certificate keypair listed is used as the default. 
  
  The Gorouter supports both RSA and ECDSA certificates in PEM encoding. In the case that a certificate chain is required, the order should be as follows: primary certificate, intermediate certificate, then root certificate.
  
  ### <a id="how-to-config-mult-certs"></a> How to Configure Multiple Certificate Keypairs
  
  