anchor.diff:  
   ## <a id="gorouter_term"></a> Terminating TLS at the Gorouter Only
   
  -In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
  +In this configuration, the load balancer does not terminate TLS for <%= vars.app_runtime_abbr %> domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
   
   This option is the recommended and more performant option, establishing and terminating a single TLS connection.
   
  
positive.code: 
  If you terminate TLS at your load balancer, you must also configure the load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` HTTP headers to the HTTP traffic it passes to the Gorouter.
  
  For more information about HTTP headers in CF, see the [HTTP Headers](../concepts/http-routing.html#http-headers) section of the _HTTP Routing_ topic. If you are configuring the forwarding of client certificates, see the [Forward Client Certificate to Apps](../concepts/http-routing.html#forward-client-cert) section of the _HTTP Routing_ topic.
  
  ### <a id="lb"></a> Procedure: Load Balancer Only
  
  
negative.code: owner: Routing
  ---
  
  <% current_page.data.title = "Securing Traffic into " + vars.app_runtime_full %>
  
  This topic describes the options for securing HTTP traffic into your <%= vars.app_runtime_full %> (<%= vars.app_runtime_abbr %>) deployment with TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.
  
  <%=vars.ssl_config%>
  
  