anchor.diff:  [[metrics-using-secrets-byo-certs]]
   ==== Providing Your Own Certificates
   
  -To provide your own certificates and replace the internally used ones, you
  -can pass these values as xref:../dev_guide/secrets.adoc#dev-guide-secrets[secrets] to the
  -Metrics Deployer.
  +To provide your own certificates and replace the internally used ones, you can
  +pass these values as xref:../dev_guide/secrets.adoc#dev-guide-secrets[secrets]
  +to the Metrics Deployer.
  +
  +The preferred metrics deployment method is to pass the metrics secret with no
  +certificates:
  +
  +====
  +----
  +$ oc secrets new metrics-deployer nothing=/dev/null
  +----
  +====
  +
  +Then, use the a xref:metrics-reencrypting-route[re-encrypting route] to pass
  +your custom certificates to Heapster. This allows for greater control in
  +modifying the certificates in the future.
   
   [NOTE]
   ====
  -Alternatively, you can use a
  -xref:../install_config/cluster_metrics.adoc#metrics-reencrypting-route[re-encrypting
  -route] which allow the self-signed certificates to remain in use internally
  +Using a xref:metrics-reencrypting-route[re-encrypting
  +route] allows the self-signed certificates to remain in use internally
   while allowing your own certificates to be used for externally access. To use a
   re-encrypting route, do not set the certificates as a secret, but a secret named
   *metrics-deployer* must still exist before the Metrics Deployer can complete.
  
positive.code: properly.
  
  |===
  
  [[metrics-using-secrets-autogenerated]]
  ==== Using Generated Self-Signed Certificates
  
negative.code: as the value specified in `*HAWKULAR_METRICS_HOSTNAME*`.
  
  If you are unable to add the internal host name to your certificate, then you
  can use the xref:metrics-reencrypting-route[re-encrypting route] method.
  ====
  
  The following table contains more advanced configuration options, detailing all
  