anchor.diff:  secret].
   ====
   
  -By default, the Hawkular Metrics server uses self-signed certificates, which are
  -not trusted by a browser or other external services. If you want to provide your
  -own trusted certificate to be used for external access, you can do so using a
  -route with a
  -link:../architecture/core_concepts/routes.html#secured-routes[re-encryption
  -termination] after deploying the metrics components.
  +By default the Hawkular Metrics server uses an internally-signed certificate which is not
  +trusted by browsers or other external services. If you wish to provide your own trusted
  +certificate to be used for external access you can do so using a route with
  +link:../architecture/core_concepts/routes.html#secured-routes[re-encryption termination].
  +
  +Creating this new route requires deleting the default route that just passes through to
  +an internally-signed certificate:
   
   . First, delete the default route that uses the self-signed certificates:
   +
  
positive.code: $ oc delete route hawkular-metrics
  ----
  
  . Define a new route with a
  link:../architecture/core_concepts/routes.html#secured-routes[re-encryption
  termination]:
  +
  ====
  [source,yaml]
  ----
  apiVersion: v1
  kind: Route
  metadata:
    name: hawkular-metrics-reencrypt
  spec:
    host: hawkular-metrics.example.com <1>
    port:
  ifdef::openshift-enterprise[]
      targetPort: 8444
  endif::[]
  ifdef::openshift-origin[]
      targetPort: 8443
  endif::[]
    to:
      kind: Service
      name: hawkular-metrics
    tls:
      termination: reencrypt
      key: |-
        -----BEGIN PRIVATE KEY-----
        [...] <2>
        -----END PRIVATE KEY-----
      certificate: |-
        -----BEGIN CERTIFICATE-----
        [...] <2>
        -----END CERTIFICATE-----
      caCertificate: |-
        -----BEGIN CERTIFICATE-----
        [...] <2>
        -----END CERTIFICATE-----
      destinationCACertificate: |-
        -----BEGIN CERTIFICATE-----
        [...] <3>
        -----END CERTIFICATE-----
  ----
  <1> The value specified in the *HAWKULAR_METRICS_HOSTNAME* template parameter.
  <2> These need to define the custom certificate you wish to provide.
  
negative.code: {product-title} installation. If so, the template can be found at the following GitHub
  location:
  
  https://github.com/openshift/openshift-ansible/blob/master/roles/openshift_examples/files/examples/v1.2/infrastructure-templates/origin/metrics-deployer.yaml
  ====
  
  endif::[]
  