anchor.diff:  
   If you terminate TLS at your load balancer but it does not support HTTP, such that it cannot append HTTP headers, a workaround exists. You should use this workaround **only if your load balancer does not accept unencrypted requests**. Configure your load balancer to send the client IP address using the PROXY protocol, and enable PROXY in the Gorouter. As the `X-Forwarded-Proto` header is stripped, configure the Gorouter to force-set this header to 'HTTPS'.
   
  -For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of the _HTTP Routing_ topic. If you are configuring the forwarding of client certificates, see the [Forward Client Certificate to Apps](../concepts/http-routing.html#forward-client-cert) section of the _HTTP Routing_ topic.
  +For more information about HTTP headers in <%= vars.app_runtime_abbr %>, see [HTTP Headers](../concepts/http-routing.html#http-headers) in _HTTP Routing_. If you are configuring the forwarding of client certificates, see [Forward Client Certificate to Apps](../concepts/http-routing.html#forward-client-cert) in _HTTP Routing_.
   
   ### <a id="lb-and-router"></a> Procedure: Load Balancer and Gorouter
   
  
positive.code: 
  In this deployment scenario, the following guidelines apply:
  
  - Certificates for the <%= vars.app_runtime_abbr %> domains must be stored on the load balancer, as well as on the Gorouter.
  
  - Generate certificates for your load balancer and the Gorouter with different keys. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice-versa.
  
  - If you choose to host only one certificate on the Gorouter and many on your load balancer, configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.
  
  ### <a id="hostname_verfication"></a> About Hostname Verification
  
  
negative.code: 
  This topic describes the options for securing HTTP traffic into your <%= vars.app_runtime_full %> (<%= vars.app_runtime_abbr %>) deployment with TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
  
  <%= vars.ssl_config %>
  
  
  ## <a id="protocol_support"></a> Protocol Support
  