anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes how to secure traffic into your Cloud Foundry (CF) deployment with SSL/TLS certificates. You can configure your deployment to specify where to terminate TLS depending on your needs.
  +This topic describes how to secure traffic into your Cloud Foundry (CF) deployment with SSL/TLS certificates. You can configure your deployment to specify where to terminate TLS depending on your needs. You must also configure the load balancer to append the X-Forwarded-For and X-Forwarded-Proto HTTP headers to the HTTP traffic it passes to the router.
   
   The advantages of securing the connection between your load balancer and router instances include:
   
  
positive.code: 
  <p class="note"><strong>Note</strong>: If your CF deployment uses a self-signed certificate, the client needs to install only the certificate stored on the load balancer.</p> 
  
  To enable this configuration, you must add your certificate to your load balancer and configure its listening port. The procedures vary depending on your IaaS. You must also insert the certificate into your deployment manifest for the CF router by completing the steps below.
  
  1. Use `bosh edit deployment` to open your release manifest for editing.
  
  1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  
  	```
  	properties:
  	  router:
  	    ssl_cert: |
  	      -----BEGIN CERTIFICATE-----
  	      SSL_CERTIFICATE_SIGNED_BY_PRIVATE_KEY
  	      -----END CERTIFICATE-----
  	    ssl_key: |
  	      -----BEGIN RSA PRIVATE KEY-----
  	      RSA_PRIVATE_KEY
  	      -----END RSA PRIVATE KEY-----
  	    enable_ssl: true
  	```
  
  
  ##<a id="lb"></a> Terminate TLS at Load Balancer Only
  <%= image_tag("lb.png") %>
  
  In this configuration, your load balancer terminates TLS, and passes unencrypted traffic to the router, which routes it to your app. To enable this configuration, you must add your certificate to your load balancer and configure its listening port. The procedures vary depending on your IaaS.
  
negative.code: * The CF router only supports HTTP requests. Whatever configuration you choose for securing traffic, it must result in the CF router receiving HTTP requests.
  * The CF router currently only supports configuring a single HTTPS certificate. [Subject Alternative Name](https://tools.ietf.org/html/rfc5280#section-4.2.1.6), an X.509 extension, can be used to associate multiple domains, including wildcard domains, to a single certificate.
  
  ##<a id="pass-through"></a> Terminate TLS at Router Only
  <p class='note'><strong>Note</strong>: This is the recommended approach.</p>
  <%= image_tag("pass-through.png") %>
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the router. This is the more performant option, establishing and terminating a single TLS connection. The certificate on the router must be associated with the correct hostname so that HTTPS can validate the request, and signed by a trusted CA.
  
  To enable this configuration, perform the following steps:
  
  1. Configure your load balancer to pass through requests from the client to the CF router. 
  1. Configure your load balancer to append the X-Forwarded-For and X-Forwarded-Proto headers to client requests if possible. If the HTTP request that reaches the router does not include the X-Forwarded headers, the router sets X-Forwarded-For to the IP address of the load balancer, and X-Forwarded-Proto to the scheme of the client request.
  1. Insert the certificate into your deployment manifest for the CF router:
  	1. Use `bosh edit deployment` to open your release manifest for editing.
  	1. Copy the contents of your certificate file into the `properties.router.ssl_cert` field and the contents of the private key file associated with your certificate into the `properties.router.ssl_key` field. Set `enable_ssl` to `true`.
  
  		```
  		properties:
  		  router:
  		    ssl_cert: |
  		      -----BEGIN CERTIFICATE-----
  		      SSL_CERTIFICATE_SIGNED_BY_PRIVATE_KEY
  		      -----END CERTIFICATE-----
  		    ssl_key: |
  		      -----BEGIN RSA PRIVATE KEY-----
  		      RSA_PRIVATE_KEY
  		      -----END RSA PRIVATE KEY-----
  		    enable_ssl: true
  		```
  
  ##<a id="lb-and-router"></a> Terminate TLS at Load Balancer and Router
  <%= image_tag("lb-and-router.png") %>
  