_haproxy_router_tls_forward.html.md.erb

Under **HAProxy forwards requests to Router over TLS**, select **Enable** or **Disable** based on your deployment layout.
      <%= image_tag 'images/networking_haproxy_router_tls_forward.png' %>
    * **Enable HAProxy forwarding of requests to Router over TLS**
     <table>
      <tr>
        <th>
          If you want to:
        </th>
        <td>
          Encrypt communication between HAProxy and the Gorouter
        </td>
      </tr>
      <tr>
        <th>
          Then configure the following:
        </th>
        <td>
          <ol>
            <li>
            Leave <b>Enable</b> selected.
            </li>
            <li>
            In the <b>Certificate Authority for HAProxy Backend</b> field, specify the Certificate Authority (CA) that signed the certificate you configured in the <b>Certificate and Private Key for HAProxy and Router</b> field.
              <p class="note"><strong>Note</strong>: If you used the <b>Generate RSA Certificate</b> link to generate a self-signed certificate, then the CA to specify is the Ops Manager CA, which you can locate at the CA endpoint in the Ops Manager API.</p>
            </li>
            <li>
            Make sure that Gorouter and HAPRoxy have TLS cipher suites in common in the <b>TLS Cipher Suites for Router</b> and <b>TLS Cipher Suites for HAProxy</b> fields.
            </li>
          </ol>
        </td>
      </tr>
      <tr>
        <th>
          See also:
        </th>
        <td>
          <ul>
          <li>
            [Terminating SSL/TLS at the Load Balancer and Gorouter](../adminguide/securing-traffic.html)
          </li>
          <li>
            [Providing a Certificate for Your SSL/TLS Termination Point](../opsguide/security_config.html#config)
          </li> 
          <li>
            [Using the Ops Manager API](http://docs.pivotal.io/pivotalcf/customizing/ops-man-api.html)
          </li>
        </ul>
      </td>
    </tr>
    </table>
   * **Disable HAProxy forwarding of requests to Router over TLS**
   <table>
     <tr>
      <th>If you want to:</th>
       <td>
        Use non-encrypted communication between HAProxy and Gorouter, or you are not using HAProxy
      </td>
      </tr>
    <tr>
      <th>Then configure the following:</th>
      <td><ol><li>Select **Disable**.</li>
      <li>If you are not using HAProxy, set the number of HAProxy job instances to 0 on the **Resource Config** page. See [Configuring Resources](#resources).</li>
      </ol></td>
    </tr>
      <tr>
      <th>See also:</th>
      <td><ul><li>[Terminating SSL/TLS at the Gorouter Only](../adminguide/securing-traffic.html#gorouter_term)</li>
      <li>[Terminating SSL/TLS at the Load Balancer Only](../adminguide/securing-traffic.html#lb_term)
      </ul>
      </td>
    </tr>
    </table>