<commit_before>---
title: Securing Traffic into Cloud Foundry
owner: Routing
---

<strong><%= modified_date %></strong>

This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.

<%=vars.ssl_config%>

## <a id="protocol_support"></a>Protocol Support

Gorouter supports HTTP/HTTPS requests only. For more information about features supported by the Gorouter, see the [HTTP Routing](../concepts/http-routing.html) topic.

To secure non-HTTP traffic over TCP Routing, terminate TLS at your load balancer or at the application. See [TCP Routing](enabling-tcp-routing.html) for details.

##<a id="ssl_options"></a>SSL/TLS Termination Options for HTTP Routing

There are three options for terminating SSL/TLS for HTTP traffic. You can terminate TLS at the Gorouter, your load balancer, or at both.

The following table summarizes SSL/TLS termination options and which option to choose for your deployment.

<table border="1" class="nice">
<tr>
  <th>If the following applies to you:</th>
  <th>Then configure SSL/TLS termination at:</th>
  <th>Related topic and configuration procedure</th>
</tr>
<tr>
  <td>
    <ul>
      <li>You want the optimum balance of performance and security, and</li>
      <li>You want to make minimum changes to your load balancer.</li>
    </ul>
  </td>
  <td>Gorouter only
  </td>
  <td> <a href="#gorouter_term">Terminating SSL/TLS at the Gorouter Only</a>
  </td>
</tr>
<tr>
  <td>
    <ul>
      <li>You require TLS termination at a load balancer, and</li>
      <li>You want a higher level of security, and</li>
      <li>You do not mind a slightly less performant deployment</li>
  </td>
  <td>
   Load Balancer and Gorouter
  </td>
  <td><a href="#lb_and_gorouter_term">Terminating SSL/TLS at the Load Balancer and Gorouter</a>
  </td>
</tr>
<tr>
  <td>
    <ul>
      <li>You require TLS termination at a load balancer, and</li>
      <li>You would prefer traffic between Load Balancer and Gorouter is unencrypted.</li>
    </ul>
  </td>
  <td>Load Balancer only
  </td>
  <td><a href="#lb_term">Terminating SSL/TLS at the Load Balancer Only</a>
  </td>
</tr>
</table>

## <a id="certtypes"></a> Certificate Requirements

The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%><span>:</span>

* In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
* The Gorouter supports SNI and can be configured with multiple certificates, each which may optionally include wildcard and alternative names.
* If you must terminate TLS at your load balancer, you may optionally secure requests from the load balancer to the Gorouter by terminating TLS at the Gorouter also. To accomplish this configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.

## <a id="ciphers"></a> Cipher Suites

By default Gorouter supports the following cipher suites, both of which require TLSv1.2:

<table>
  <tr>
    <th>RFC</th>
    <th>OpenSSL</th>
  </tr>
  <tr>
    <td>TLS_RSA_WITH_AES_128_GCM_SHA256</td>
    <td>AES128-GCM-SHA256</td>
  </tr>
  <tr>
    <td>TLS_RSA_WITH_AES_256_GCM_SHA384</td>
    <td>AES256-GCM-SHA384</td>
  </tr>
</table>

<%= vars.cipher_suites %>

The following cipher suites are optionally supported for TLS1.2 only:

<table>
  <tr>
    <th>RFC</th><commit_msg>Adding notes on support for mutual TLS<commit_after>---
title: Securing Traffic into Cloud Foundry
owner: Routing
---

<strong><%= modified_date %></strong>

This topic describes the options for securing HTTP traffic into your <%=vars.product_full%> <%=vars.product_abbr%> deployment with SSL/TLS certificates. You can configure the location where your deployment terminates TLS depending on your needs and certificate restrictions.

<%=vars.ssl_config%>

## <a id="protocol_support"></a>Protocol Support

Gorouter supports HTTP/HTTPS requests only. For more information about features supported by the Gorouter, see the [HTTP Routing](../concepts/http-routing.html) topic.

To secure non-HTTP traffic over TCP Routing, terminate TLS at your load balancer or at the application. See [TCP Routing](enabling-tcp-routing.html) for details.

##<a id="ssl_options"></a>SSL/TLS Termination Options for HTTP Routing

There are three options for terminating SSL/TLS for HTTP traffic. You can terminate TLS at the Gorouter, your load balancer, or at both.

The following table summarizes SSL/TLS termination options and which option to choose for your deployment.

<table border="1" class="nice">
<tr>
  <th>If the following applies to you:</th>
  <th>Then configure SSL/TLS termination at:</th>
  <th>Related topic and configuration procedure</th>
</tr>
<tr>
  <td>
    <ul>
      <li>You want the optimum balance of performance and security, and</li>
      <li>You want to make minimum changes to your load balancer.</li>
    </ul>
  </td>
  <td>Gorouter only
  </td>
  <td> <a href="#gorouter_term">Terminating SSL/TLS at the Gorouter Only</a>
  </td>
</tr>
<tr>
  <td>
    <ul>
      <li>You require TLS termination at a load balancer, and</li>
      <li>You want a higher level of security, and</li>
      <li>You do not mind a slightly less performant deployment</li>
  </td>
  <td>
   Load Balancer and Gorouter
  </td>
  <td><a href="#lb_and_gorouter_term">Terminating SSL/TLS at the Load Balancer and Gorouter</a>
  </td>
</tr>
<tr>
  <td>
    <ul>
      <li>You require TLS termination at a load balancer, and</li>
      <li>You would prefer traffic between Load Balancer and Gorouter is unencrypted.</li>
    </ul>
  </td>
  <td>Load Balancer only
  </td>
  <td><a href="#lb_term">Terminating SSL/TLS at the Load Balancer Only</a>
  </td>
</tr>
</table>

## <a id="certtypes"></a> Certificate Requirements

The following requirements apply to the certificates you use to secure traffic into <%=vars.product_short%><span>:</span>

* In a production environment, use a signed SSL/TLS certificate (trusted) from a known certificate authority (CA).
* In a development or testing environment, you can use a trusted CA certificate or a self-signed certificate generated with `openssl` or a similar tool. 
* If you must terminate TLS at your load balancer, you may optionally secure requests from the load balancer to the Gorouter by terminating TLS at the Gorouter also. To accomplish this configure your load balancer with the CA and hostname with which to validate the certificate hosted by the Gorouter.
* The Gorouter supports SNI and can be configured with multiple certificates, each which may optionally include wildcard and alternative names.
* The Gorouter supports mutual TLS; the Gorouter will validate a client provided certificate chain against its CA certificates if one is provided in the TLS handshake, but does not require it. Depending on whether you choose to terminate at both the load balancer and Gorouter, or at Gorouter alone, the client certificate may that of the load balancer or of the originating client.

## <a id="ciphers"></a> Cipher Suites

By default Gorouter supports the following cipher suites, both of which require TLSv1.2:

<table>
  <tr>
    <th>RFC</th>
    <th>OpenSSL</th>
  </tr>
  <tr>
    <td>TLS_RSA_WITH_AES_128_GCM_SHA256</td>
    <td>AES128-GCM-SHA256</td>
  </tr>
  <tr>
    <td>TLS_RSA_WITH_AES_256_GCM_SHA384</td>
    <td>AES256-GCM-SHA384</td>
  </tr>
</table>

<%= vars.cipher_suites %>

The following cipher suites are optionally supported for TLS1.2 only:

<table>
  <tr>
    <th>RFC</th>
{'fraction_non_alphanumeric': 0.10220924327069579, 'fraction_numerical': 0.007364144235652616, 'mean_word_length': 4.11825860948668, 'pattern_counts': {'":': 0, '<': 205, '<?xml version=': 0, '>': 205, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4772119', 'n_tokens_mistral': 2482, 'n_tokens_neox': 2333, 'n_words': 978}