anchor.diff:  === Metrics Deployer Secrets
   
   By default, the *metrics deployer* auto-generates self-signed certificates for
  -use between components. To provide your own certificates, you can pass these
  -values as link:../dev_guide/secrets.html[secrets] to the *metrics deployer*.
  +use between components. Since these are self-signed certificates they will not
  +be automatically trusted by a web browser and it is advisable to use your own
  +certificates for anything being accessed outside of the OpenShift cluster. This
  +is especially important for the Hawkular Metrics server as it needs to be accessible 
  +in a browser for the console to function.
  +
  +To provide your own certificates and replace the internally used ones, you 
  +can pass these values as link:../dev_guide/secrets.html[secrets] to the 
  +*metrics deployer*.
  +
  +Alternatively you can instead use a 
  +link:../install_config/cluster_metrics.html#reencrypting-route[re-encrypting route] which 
  +will allow the self-signed certificates to remain used internally while allowing your own 
  +certificates to be used for externally access. If you wish to use a re-encrypting route
  +you should not set the certificates as a secret.
  + 
   
   [WARNING]
   ====
  -By default, the Hawkular Metrics service uses self-signed certificates, which
  -can cause problems when the console accesses it in a web browser. As an
  -alternative, you can specify your own *_hawkular-metrics.pem_* secret to use a
  -certificate that is trusted by the browser.
  -
  -When supplying your own certificate for the Hawkular Metrics service, it must
  -contain both the host name specified for the route as well as the internally
  -used *hawkular-metrics* host name.
  +Setting the value via secrets will *replace* the internally used certificates and as such these 
  +certificates *must* be valid for both the externally used hostnames as well as the externally hostname. For
  +`hawkular-metrics` this means the certificate must be value if *'hawkular-metrics'* as well
  +as the value specified in *HAWKULAR_METRICS_HOSTNAME*.
  +
  +If you are unable to add the internal hostname to your certificate, then you will need to a 
  +link:../install_config/cluster_metrics.html#reencrypting-route[re-encrypting route].
   ====
   
   Optionally, provide your own certificate that is configured to be trusted by
  
positive.code: ----
  ====
  
  [[configuring-openshift-metrics]]
  
  == Configuring OpenShift
  
negative.code: 
  |*_hawkular-metrics.pem_*
  |The *_pem_* file to use for the Hawkular Metrics certificate. This certificate
  must contain the *'hawkular-metrics'* host name as well as the publicly available
  host name used by the route. This file is auto-generated if unspecified.
  
  |*_hawkular-metrics-ca.cert_*
  