anchor.diff:  <%= partial '../opsguide/ssl_termin_gorouter_pcf' %>
   <% end %>
   
  +##<a id="lb_term"></a> Terminating SSL/TLS at the Load Balancer Only
  +
  +In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the Gorouter, which routes it to your app. Traffic between the load balancer and the Gorouter is not encrypted.
  +
  +This option is recommended if you cannot use SAN certificates and if you do not require traffic to be encrypted between the load balancer and the Gorouter.
  +
  +The following diagram illustrates communication between the client, load balancer, Gorouter and app.
  +
  +<%= image_tag("lb.png") %>
  +
  +### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  +
  +You can use multiple certificates on your load balancer if the load balancer supports multiple VIPs or SNI.
  +
  +### <a id="http_header_lb"></a> About HTTP Header Forwarding
  +
  +If you terminate SSL/TLS at your load balancer, then you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  +
  +### <a id="lb"></a> Procedure: Load Balancer Only
  +
  +<% if vars.product_name == 'CF' %>
  +<%= partial 'ssl_termin_lb_only_oss' %>
  +<% else %>
  +<%= partial '../opsguide/ssl_termin_lb_only_pcf' %>
  +<% end %>
  +
   ##<a id="lb_and_gorouter_term"></a>Terminating SSL/TLS at the Load Balancer and Gorouter
   
   In this configuration two TLS connections are established: one from the client to the load balancer, and another from the load balancer to the Gorouter. This configuration secures all traffic between the load balancer and the Gorouter.
  
positive.code: - If a client provides an SNI header with a ServerName that does not match to a certificate in `router.tls_pem`, gorouter will return the default certificate
  - If a client does not provide an SNI header and the requested hostname matches to a certificate in `router.tls_pem`, gorouter will return the matching certificate.
  - If a client does not provide an SNI header and requested hostname does not match to a certificate in `router.tls_pem`, gorouter will return the default certificate.
  
  
  
negative.code: 
  ## <a id="ciphers"></a> Cipher Suites
  
  By default Gorouter supports the following cipher suites, both of which require TLSv1.2:
  
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  
  The following cipher suites are optionally supported for TLS1.2 only:
  
      TLS_RSA_WITH_AES_128_CBC_SHA256
      TLS_RSA_WITH_AES_128_GCM_SHA256
      TLS_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_RSA_WITH_RC4_128_SHA
      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
  
  The following cipher suites are optionally supported for TLS1.0 and 1.2 only:
  
      TLS_RSA_WITH_RC4_128_SHA
      TLS_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_RSA_WITH_AES_128_CBC_SHA
      TLS_RSA_WITH_AES_256_CBC_SHA
  
  <%= vars.cipher_suites %>
  
  See [Golang Constants](https://golang.org/pkg/crypto/tls/#pkg-constants) and [OpenSSL Cipher Suites](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html) for more information about supported ciphers.
  
  <p class="note"><strong>Note</strong>: ECDSA ciphers require a certificate and key for DSA, as opposed to RSA.</p>
  
  ##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
  
  This option is the recommended and more performant option, establishing and terminating a single TLS connection.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  
  