anchor.diff:  
   Traffic between the load balancer and the Gorouter is encrypted only if the client request is encrypted.
   
  -### <a id="cert_guidelines_gorouter"></a>Certificate Guidelines
  -
  -* The Gorouter currently supports configuring multiple HTTPS certificates using the `router.tls_pem` property.
  -* Use of Subject Alternative Names is recommended because <%=vars.product_short%> requires wildcard domains.
  -
   ### <a id="http_header_gorouter"></a>About HTTP Header Forwarding
   
   If you terminate TLS/SSL at the Gorouter only, your load balancer does not send HTTP headers.
  
positive.code: 
  <%= image_tag("lb.png") %>
  
  ### <a id="cert_guidelines_lb"></a> Certificate Guidelines
  
  You can use multiple certificates on your load balancer if the load balancer supports multiple VIPs or SNI.
  
  ### <a id="http_header_lb"></a> About HTTP Header Forwarding
  
  If you terminate SSL/TLS at your load balancer, then you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  
negative.code: 
  - Certificates for the <%=vars.product_short%> domains must be stored on the load balancer, as well as on Gorouter.
  - Generate certificates for your load balancer and Gorouter with different keys. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice versa.
  - If you choose to host only one certificate on Gorouter and many on your load balancer, configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.
  
  ### <a id="hostname_verfication"></a> About Hostname Verification
  
  