anchor.diff:    </tr>
   </tr>
   </table>
  -     
  +
   
   ## <a id="certtypes"></a> Certificate Requirements
   
   The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%><span>:</span>
   
   * In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
  -* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
  +* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool.
   * The Gorouter currently only supports configuring a single HTTPS certificate. The certificate on the Gorouter must be associated with all the domains it may receive requests for so that HTTPS can validate the request. To associate multiple domains to a single certificate, including wildcard domains, use [Subject Alternative Name (SAN)](https://tools.ietf.org/html/rfc5280#section-4.2.1.6), an X.509 extension.
   * If wildcard certificates are not supported for some or all of your domains, then terminate TLS at your load balancer.
   * If you cannot use a SAN certificate, terminate TLS at your load balancer.
  
positive.code: 
  ## <a id="ciphers"></a> Cipher Suites
  
  By default, Gorouter supports the following cipher suites:
  
  * TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256
  * TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384
  
  <%= vars.cipher_suites %>
  
  See the [Golang repository on Github](https://github.com/golang/go/blob/release-branch.go1.7/src/crypto/tls/cipher_suites.go#L269-L285) for more information about supported ciphers.
  
  <p class="note"><strong>Note</strong>: ECDSA ciphers require a certificate and key for DSA, as opposed to RSA.</p>
  
  ##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter. 
  
  This option is the recommended and more performant option, establishing and terminating a single TLS connection. 
  
  The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  
  
negative.code: 
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  
  This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted between the load balancer and the Gorouter.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter and app.
  
  