anchor.diff:  
   ## <a id="ciphers"></a> Cipher Suites
   
  -By default, Gorouter supports the following cipher suites:
  -
  -* TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256
  -* TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384
  +By default Gorouter supports the following cipher suites, both of which require TLSv1.2:
  +
  +    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  +    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  +
  +The following cipher suites are optionally supported for TLS1.2 only:
  +
  +    TLS_RSA_WITH_AES_128_CBC_SHA256
  +    TLS_RSA_WITH_AES_128_GCM_SHA256
  +    TLS_RSA_WITH_AES_256_GCM_SHA384
  +    TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  +    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  +    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  +    TLS_ECDHE_RSA_WITH_RC4_128_SHA
  +    TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  +    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  +    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  +    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  +    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  +    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  +    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  +    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  +    TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  +    TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
  +    TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
  +
  +The following cipher suites are optionally supported for TLS1.0 and 1.2 only:
  +
  +    TLS_RSA_WITH_RC4_128_SHA
  +    TLS_RSA_WITH_3DES_EDE_CBC_SHA
  +    TLS_RSA_WITH_AES_128_CBC_SHA
  +    TLS_RSA_WITH_AES_256_CBC_SHA
   
   <%= vars.cipher_suites %>
   
  -See the [Golang repository on Github](https://github.com/golang/go/blob/release-branch.go1.7/src/crypto/tls/cipher_suites.go#L269-L285) for more information about supported ciphers.
  +See [Golang Constants](https://golang.org/pkg/crypto/tls/#pkg-constants) and [OpenSSL Cipher Suites](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html) for more information about supported ciphers.
   
   <p class="note"><strong>Note</strong>: ECDSA ciphers require a certificate and key for DSA, as opposed to RSA.</p>
   
   ##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
   
  -In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter. 
  -
  -This option is the recommended and more performant option, establishing and terminating a single TLS connection. 
  +In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
  +
  +This option is the recommended and more performant option, establishing and terminating a single TLS connection.
   
   The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
   
  
positive.code: 
  ##<a id="ssl_options"></a>SSL/TLS Termination Options for HTTP Routing
  
  There are three options for terminating SSL/TLS for HTTP traffic. You can terminate TLS at the Gorouter, your load balancer, or at both. 
  
  The following table summarizes SSL/TLS termination options and which option to choose for your deployment.
  
  
negative.code: 
  <strong><%= modified_date %></strong>
  
  This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
  
  <%=vars.ssl_config%>
  
  