anchor.diff:  
   ##<a id='stub'></a> Step 3: Create Your Manifest Stub
   
  -###<a id="example-stub"></a> Get Cloud Foundry Deployment Manifest Stub for Azure
  -Get the [example manifest stub](https://raw.githubusercontent.com/cloudfoundry-incubator/bosh-azure-cpi-release/master/docs/stubs/cf/cf-stub.yml) for Azure, and then follow this editing instructions to customize it for your deployment.
  -
  -###<a id="editing"></a>Editing Instructions
  +To create your manifest stub, download the example manifest stub for Azure from GitHub, then customize it for your deployment.
  +
  +###<a id="example-stub"></a> Download the Example Manifest Stub 
  +
  +[Download the example manifest stub for Azure from GitHub](https://raw.githubusercontent.com/cloudfoundry-incubator/bosh-azure-cpi-release/master/docs/stubs/cf/cf-stub.yml).
  +
  +###<a id="editing"></a>Customize the Manifest 
  +
  +Follow the instructions in this table to edit the manifest stub for your deployment.
  +
   <table border="1" class="nice">
     <tr>
       <th style="width:35%">Deployment Manifest Stub Contents</th>
  
positive.code:           <th>with the contents of this file&hellip;</th>
          </tr>
          <tr>
            <td><code>CC_MUTUAL_TLS_CA_CERT</code></td>
            <td><code>cf-diego-ca.crt</code></td>
          </tr>
          <tr>
            <td><code>CC_MUTUAL_TLS_PUBLIC_CERT</code></td>
            <td><code>cloud_controller.crt</code></td>
          </tr>
          <tr>
            <td><code>CC_MUTUAL_TLS_PRIVATE_KEY</code></td>
            <td><code>cloud_controller.key</code></td>
          </tr>
        </table>
  
negative.code:   ccdb:
      roles:
      - name: ccadmin
        password: CCDB-PASSWORD
    uaadb:
      roles:
        - name: uaaadmin
          password: UAADB-PASSWORD
    databases:
      roles:
      - name: ccadmin
        password: CCDB-PASSWORD
      - name: uaaadmin
        password: UAADB-PASSWORD
      - name: diego
        password: DIEGODB-PASSWORD
      </code></pre></td>
      <td>Replace <code>CCDB-PASSWORD</code>, <code>UAADB-PASSWORD</code>, and <code>DIEGODB-PASSWORD</code> with secure passwords of your choosing.
      </td>
    </tr>
    <tr>
      <td><pre><code>
    login:
      saml:
        serviceProviderKey: SAML-KEY
        serviceProviderKeyPassword: ''
        serviceProviderCertificate: SAML-CERT
      </code></pre></td>
      <td>
          Generate a PEM-encoded RSA key pair. Run <code>openssl req -x509 -nodes -newkey rsa:2048 -days 365 -keyout key.pem -out cert.pem</code> to generate a key pair. This command creates <code>cert.pem</code>, which contains your public key, and <code>key.pem</code>, which contains your private key. Replace <code>SERVICE-PROVIDER-PRIVATE-KEY</code> with the full private key, including the <code>BEGIN</code> and <code>END</code> delimiter lines, under <code>serviceProviderKey</code>.</br>
  For RSA keys, you only need to configure the private key.
      </td>
    </tr>
    <tr>
  