anchor.diff:  
   ##<a id="sni"></a> Support for SNI
   
  -Gorouter's `router.tls_pem` property enables support for SNI which allows operators to configure gorouter with multiple certificates. This property replaces `router.ssl_key` and `router.ssl_cert` which were previously required to terminate SSL/TLS.
  +Gorouter's `router.tls_pem` property enables support for SNI which allows operators to configure Gorouter with multiple certificates. This property replaces `router.ssl_key` and `router.ssl_cert` which were previously required to terminate SSL/TLS.
   
   The `router.tls_pem` property supports both RSA and ECDSA certificates in PEM
   encoding. This property is an array where each entry is a combination of
   private key and certificate. In the case that a certificate chain is required,
  -the order should be: primary certificate, intermediate certificate, and root
  -certificate. The private key can be either appended or prepended.
  +the order should be as follows: primary certificate, intermediate certificate, then root certificate. The private key can be either appended or prepended.
   
   ```
    properties:
  
positive.code: 
  <%= image_tag("lb-and-router.png") %>
  
  This option is less performant, but it does allow for termination at a load balancer as well as secure traffice between the load balancer and Gorouter. 
  
  ### <a id="cert_guidelines_lb_gorouter"></a> Certificate Guidelines
  
  
negative.code: 
  If you terminate SSL/TLS at your load balancer, then you must configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to requests it sends to the Gorouter.
  
  If you terminate SSL/TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. We recommend you use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in Gorouter. As the `X-Forwarded-Proto` header will not be present, configure Gorouter to force-set this header to 'HTTPS'. 
  
  ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
  
  