_xfcc_router.html.md.erb

#### <a id="xfcc_haproxy"></a> Terminating TLS at Gorouter

If the Gorouter is the first component to terminate TLS, such that it receives the certificate of the originating client in the mutual TLS handshake, the operator should select this option. When selected, Gorouter sets the XFCC header to the contents of the client certificate received in the TLS handshake and strips the XFCC header when present in a request.

Selecting this configuration requires that the load balancer in front of Gorouter is configured to pass through TLS handshake to Gorouter via TCP. 

This mode is enabled when the <b>TLS terminated for the first time at the Router</b> option is selected in the **Networking** configuration screen of the PAS tile.

Gorouter trusts the Diego intermediate certificate authority. This trust is enabled automatically and permits mutual authentication between applications that are running on Pivotal Cloud Foundry.