anchor.diff:  
   Currently, password protected key files are not supported. HAProxy prompts you
   for a password upon starting and does not have a way to automate this process.
  -To remove a passphrase from a keyfile, you can run:
  -
  -****
  -`# openssl rsa -in _<passwordProtectedKey.key>_ -out _<new.key>_`
  -****
  -
  -When creating a secure route, you must include your certificate files as a
  -single line of text. Replace the existing line breaks with:
  -
  -****
  -`\n`
  -****
  +To remove a passphrase from a keyfile, run:
  +
  +----
  +# openssl rsa -in <passwordProtectedKey.key> -out <new.key>
  +----
  +
  +When creating a secure route, include your certificate files as a single line of
  +text. Replace the existing line breaks with:
  +
  +----
  +\n
  +----
   
   == Routers
   A template router provides certain infrastructure information to the underlying
  
positive.code: link:../../dev_guide/deployments.html[Deployments] can use these services as
  local proxies for each host, or reuse the shared routing infrastructure.
  
  As an OpenShift administrator, you can configure routers in your instance. This
  allows developers to then set the route types for their projects.
  
  == Route Types
  Routes can be either secure or unsecure. Secure routes provide the ability to
  use different types of TLS termination to serve certificates to the client.
  Routers support link:#edge-termination[edge],
  link:#passthrough-termination[passthrough], and
  
negative.code: [[wildcard-certificates]]
  *Wildcard Certificates*
  
  Depending on your implementation, you can use a default certificate. Default
  certificates are useful for implementing a wildcard certificate for the router.
  For example, if you have many routes that end in `example.com` you may wish to
  install a router with a wildcard certificate for `*.example.com`.
  
  To provide the default certificate to the router you must specify it in the
  create command with the `--default-cert` option. The certificate should be a
  concatenated file of the key, certificate, and any CA certificates that are
  required by the browser. The certificate must be in a form acceptable by the
  underlying router implementation. In the case of HAProxy it should be a
  PEM-based certificate.
  
  ----
  $ oadm router --credentials="$KUBECONFIG" --default-cert=/full/path/to/certificate.pem
  ----
  
  For HAProxy, if a default certificate is provided, it will be loaded first. The
  certificate that is loaded first is presented to any route that matches the CN
  on the certificate and any route that is secure but does not match any
  configured certificates. For example, if the default certificate is for
  `\*.example.com` and a secure route for `www.foo.com` is created with no
  certificates the route will still be written and the router will serve the
  `*.example.com` certficiate. This may result in a browser warning for users
  since the CN on the certificate does not match the url. If no default
  certificate is supplied, the HAProxy router will default to a generic, expired
  certificate that is provided in the base image.
  
  [[special-notes]]
  