anchor.diff:            #######           Your New Agent Certificate        #######
             ###########################################################
             ----END CERTIFICATE----
  -          ----BEGIN CERTIFICATE----
  -          ###########################################################
  -          #######           Your Old Agent Certificate        #######
  -          ###########################################################
  -          ----END CERTIFICATE----
           agent_key: |
             -----BEGIN RSA PRIVATE KEY-----
             ###########################################################
             #######           Your New Agent Key                #######
  -          ###########################################################
  -          -----END RSA PRIVATE KEY-----
  -          -----BEGIN RSA PRIVATE KEY-----
  -          ###########################################################
  -          #######           Your Old Agent Key                #######
             ###########################################################
             -----END RSA PRIVATE KEY-----
           server_cert: |
  
positive.code:     Copy the contents of the files in the `./consul-certs` directory, as well as
      the value for your Gossip encryption key, into your stub.
  
  ## <a id='insecure'></a>Configure Insecure Mode ##
  
  1. Remove all the key- and certificate-related properties for Consul in your
  stub.
  
  1. Add the following property to your stub:
  
      ```yaml
      properties:
        ...
        consul:
          ...
          require_ssl: false
      ```
  
  ## <a id='rotating-certs'></a>SSL Certificate, Key, and Certificate Authority Rotation
  
  To rotate your SSL certificates, keys, and certificate authorities, you must
  perform the following steps.
  
  1. Add the certificates, keys, and certificate authorities that you want to
  rotate to your stub file.<br><br>You must add your new `agent_key`,
  `server_key`, and `ca_cert` above the existing certificates. Do not remove the
  existing certificates.
  
      ```yaml
      ...
  
negative.code:           #######           Your New Server Certificate       #######
            ###########################################################
            ----END CERTIFICATE----
          server_key: |
            -----BEGIN RSA PRIVATE KEY-----
            ###########################################################
            #######           Your New Server Key               #######
            ###########################################################
            -----END RSA PRIVATE KEY-----
     ```
  
  3. Remove your old CA Certificate.
     Then deploy Cloud Foundry using your updated manifest.
  
      ```yaml
      ...
      properties:
        ...
        consul:
          ...
          encrypt_keys:
          - RANDOM-SECRET-VALUE
          ca_cert: |
  