_haproxy_router_tls_forward.html.md.erb

Under **HAProxy forwards requests to Router over TLS**, select **Enable** or **Disable** based on your deployment layout.
      <%= image_tag 'images/networking_haproxy_router_tls_forward.png' %>
  <ul>
    <li><strong>Enable HAProxy forwarding of requests to Router over TLS</strong></li>
  </ul>
  <table>
    <tr>
      <th>
        If you want to:
      </th>
      <td>
        Encrypt communication between HAProxy and the Gorouter
      </td>
    </tr>
    <tr>
      <th>
        Then configure the following:
      </th>
      <td>
        <ol>
          <li>Leave <strong>Enable</strong> selected.</li>
          <li>In the <strong>Certificate Authority for HAProxy Backend</strong> field, specify the Certificate Authority (CA) that signed the certificate you configured in the <strong>Certificate and Private Key for HAProxy and Router</strong> field.<p class="note"><strong>Note</strong>: If you used the <strong>Generate RSA Certificate</strong> link to generate a self-signed certificate, then the CA to specify is the Ops Manager CA, which you can locate at the CA endpoint in the Ops Manager API.</p></li>
          <li>Make sure that Gorouter and HAPRoxy have TLS cipher suites in common in the <strong>TLS Cipher Suites for Router</strong> and <strong>TLS Cipher Suites for HAProxy</strong> fields.</li>
        </ol>
      </td>
    </tr>
    <tr>
      <th>
        See also:
      </th>
      <td>
        <ul>
          <li>[Terminating SSL/TLS at the Load Balancer and Gorouter](../adminguide/securing-traffic.html)</li>
          <li>[Providing a Certificate for Your SSL/TLS Termination Point](../opsguide/security_config.html#config)</li> 
          <li>[Using the Ops Manager API](https://docs.pivotal.io/pivotalcf/customizing/ops-man-api.html)</li>
        </ul>
      </td>
    </tr>
  </table>
  <ul>
   <li> <strong>Disable HAProxy forwarding of requests to Router over TLS</strong></li>
  </ul>
   <table>
     <tr>
      <th>If you want to:</th>
       <td>
        Use non-encrypted communication between HAProxy and Gorouter, or you are not using HAProxy
      </td>
      </tr>
    <tr>
      <th>Then configure the following:</th>
      <td><ol><li>Select **Disable**.</li>
      <li>If you are not using HAProxy, set the number of HAProxy job instances to <code>0</code> on the **Resource Config** page. See [Disable Unused Resources](#disable-resources).</li>
      </ol></td>
    </tr>
      <tr>
      <th>See also:</th>
      <td><ul><li>[Terminating SSL/TLS at the Gorouter Only](../adminguide/securing-traffic.html#gorouter_term)</li>
      <li>[Terminating SSL/TLS at the Load Balancer Only](../adminguide/securing-traffic.html#lb_term)
      </ul>
      </td>
    </tr>
    </table>