anchor.diff:  
   <%= image_tag("lb-and-router.png") %>
   
  -This option is less performant, but it does allow for use of multiple certificates under certain circumstances. 
  +This option is less performant, but it does allow for use of multiple certificates under certain circumstances.
   
   ### <a id="cert_guidelines_lb_gorouter"></a> Certificate Guidelines
   
   In this deployment scenario, the following guidelines apply:
   
   - Certificates for the <%=vars.product_short%> domains must be stored on the load balancer.
  -- On the Gorouter you can use a SAN certificate for all domains, or a standard certificate for a single domain that the load balancer has been configured to trust. In the latter case, however, you must disable hostname validation on the load balancer, as the domain of the certificate served by the Gorouter will not match requests sent to applications on <%=vars.product_short%>. 
  +- On the Gorouter you can use a SAN certificate for all domains, or a standard certificate for a single domain that the load balancer has been configured to trust. In the latter case, however, you must disable hostname validation on the load balancer, as the domain of the certificate served by the Gorouter will not match requests sent to applications on <%=vars.product_short%>.
   - If you are concerned about hosting a certificate key on the Gorouter, you can generate certificates for your load balancer for the same domains with a different key. If the key for the certificate on the Gorouter is compromised, then the certificate on the load balancer is not at risk, and vice versa.
   
  -### <a id="hostname_verfication"></a> About Hostname Verification 
  -
  -Hostname verification between the load balancer and Gorouter is unnecessary when the load balancer is already configured with the Gorouter's IP address to correctly route the request. 
  +### <a id="hostname_verfication"></a> About Hostname Verification
  +
  +Hostname verification between the load balancer and Gorouter is unnecessary when the load balancer is already configured with the Gorouter's IP address to correctly route the request.
   
   If the load balancer uses DNS resolution to route requests to the Gorouters, then you should enable hostname verification.
   
  
positive.code: <% else %>
  <%= partial '../opsguide/ssl_termin_gorouter_lb_pcf' %>
  <% end %>
  
  
  
  
negative.code: 
  ## <a id="ciphers"></a> Cipher Suites
  
  By default Gorouter supports the following cipher suites, both of which require TLSv1.2:
  
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  
  The following cipher suites are optionally supported for TLS1.2 only:
  
      TLS_RSA_WITH_AES_128_CBC_SHA256
      TLS_RSA_WITH_AES_128_GCM_SHA256
      TLS_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_RSA_WITH_RC4_128_SHA
      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
  
  The following cipher suites are optionally supported for TLS1.0 and 1.2 only:
  
      TLS_RSA_WITH_RC4_128_SHA
      TLS_RSA_WITH_3DES_EDE_CBC_SHA
      TLS_RSA_WITH_AES_128_CBC_SHA
      TLS_RSA_WITH_AES_256_CBC_SHA
  
  <%= vars.cipher_suites %>
  
  See [Golang Constants](https://golang.org/pkg/crypto/tls/#pkg-constants) and [OpenSSL Cipher Suites](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html) for more information about supported ciphers.
  
  <p class="note"><strong>Note</strong>: ECDSA ciphers require a certificate and key for DSA, as opposed to RSA.</p>
  
  ##<a id="gorouter_term"></a>Terminating SSL/TLS at the Gorouter Only
  
  In this configuration, the load balancer does not terminate TLS for CF domains at all. Instead, it passes through the underlying TCP connection to the Gorouter.
  
  This option is the recommended and more performant option, establishing and terminating a single TLS connection.
  
  The following diagram illustrates communication between the client, load balancer, Gorouter, and app.
  
  