_ssl_termin_gorouter_lb_pcf.html.md.erb

Perform the following steps to configure SSL termination on the Gorouter and load balancer in Pivotal Cloud Foundry (PCF):

1. Create an A record in your DNS that points to your load balancer IP address.
The A record associates the **System Domain** and **Apps Domain** that you
configure in the **Domains** section of the Elastic Runtime tile with the IP address of
your load balancer.
    <br />
    <br />
    For example, with `cf.example.com` as the main subdomain for your Cloud 
    Foundry (CF) deployment and a load balancer IP address `198.51.100.1`, you 
    must create an A record in your DNS that serves `example.com` and points 
    `*.cf` to `198.51.100.1`.

    <table border="1" class="nice" >
      <tr>
        <th>Name</th>
        <th>Type</th>
        <th>Data</th>
        <th>Domain</th>
      </tr>
      <tr>
        <td>*.cf</td>
        <td>A</td>
        <td>198.51.100.1</td>
        <td>example.com</td>
      </tr>
    </table>

1. Navigate to the Ops Manager Installation Dashboard.

1. Click the **Elastic Runtime** tile in the Installation Dashboard.

1. Click **Networking**.

1. For PCF deployments on OpenStack or vSphere, enter the load balancer IP address that you used to set up a wildcard DNS record in the **Router IPs** field. For more information, see the Elastic Runtime networking configuration topic for [OpenStack](../customizing/openstack-er-config.html#networking) or [vSphere](../customizing/config-er-vmware.html#networking). 

1. Under **Select one of the following point-of-entry options**, select the first option, **Forward SSL to Elastic Runtime Router**.

1. Enter your PEM-encoded certificate and your PEM-encoded private key in the fields under **Router SSL Termination Certificate and Private Key**. You can either upload your own certificate or generate a RSA certificate in Elastic Runtime. For options and instructions on creating a certificate for your wildcard domains, see the [Creating a Wildcard Certificate for PCF Deployments](../opsguide/security_config.html#create_or_obtain_certs) topic.

1. If you want to use a specific set of SSL ciphers for the Router, configure **Router SSL Ciphers**. Enter a colon-separated list of custom SSL ciphers to pass to the router. Otherwise, leave this field blank.

1. If you are not using SSL encryption or if you are using self-signed certificates, you can select **Disable SSL certificate verification for this environment**. Selecting this checkbox also disables SSL verification for route services. 
  <p class="note">Use this checkbox only for development and testing environments. Do not select it for production environments.</p>

1. Click **Save**.

1. After you complete the configuration in PCF, add your certificate or certificates to your load balancer, and configure its listening port. The procedures vary depending on your IaaS.

1. Configure your load balancer to append the `X-Forwarded-For` and `X-Forwarded-Proto` headers to client requests.

    <br>If you cannot configure the load balancer to provide the `X-Forwarded-For` header, the Gorouter appends it in requests forwarded to applications and system components, set to the IP address of the load balancer.

    <p class='note'><strong>Note</strong>: If the load balancer accepts unencrypted requests, it <strong>must</strong> provide the <code>X-Forwarded-Proto</code> header. Conversely, if the load balancer cannot be configured to send the <code>X-Forwarded-Proto</code> header, it should not accept unencrypted requests. Otherwise, applications and platform system components that require encrypted client requests will accept unencrypted requests when they should not accept them.</p>