anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions. 
  +This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
   
   <%=vars.ssl_config%>
   
  
positive.code: <%= partial '../opsguide/ssl_termin_gorouter_pcf' %>
  <% end %>
  
  ##<a id="lb_and_gorouter_term"></a>Terminating SSL/TLS at the Load Balancer and Gorouter
  
  In this configuration two TLS connections are established: one from the client to the load balancer, and another from the load balancer to the Gorouter. This configuration secures all traffic between the load balancer and the Gorouter.
  
negative.code: - Generate certificates for your load balancer and Gorouter with different keys. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice versa.
  - Configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.
  
  ### <a id="hostname_verfication"></a> About Hostname Verification
  
  Hostname verification between the load balancer and Gorouter is unnecessary when the load balancer is already configured with the Gorouter's IP address to correctly route the request.
  
  If the load balancer uses DNS resolution to route requests to the Gorouters, then you should enable hostname verification.
  
  