_aws_security_config.html.md.erb

1. Click on **Security Config**.

	<%= image_tag("security_config.png") %>

1. Provide an **SSL Termination Certificate** for your SSL Termination Point.
    This certificate must match the one that you uploaded to AWS earlier.
    <p class='note'><strong>Note</strong>: Pivotal does not recommend using a
    self-signed certificate for production deployments.</p>
  <%= partial 'known-issue-self-signed-certs' %>

1. Configure **HAProxy SSL Ciphers** and **Router SSL Ciphers**. Leave these fields blank unless you want to use a specific set of SSL ciphers for HAProxy or the Router.

1. Configure **Disable HTTP traffic to HAProxy**. If you select the **Disable HTTP traffic to HAProxy** checkbox, your deployment rejects all port 80 traffic to HAProxy. Additionally, this option sets the secure flag in the `VCAP_ID` cookie that the Router generates.

    <p class='note'><strong>Note</strong>: If you enable this checkbox and your deployment is not using HAProxy, configure your external load balancer to reject port 80 traffic. If you do not do this, traffic to port 80 is forwarded to applications but loses session stickiness.</p>

1. Configure **Enable cross container traffic**. Select this checkbox to disable the restriction that prevents containers in the same Diego Cell from communicating back to the host interface. Pivotal does not recommend selecting this checkbox.

1. Configure **Enable TLS on the Router**. Select this setting to enable [SSL termination](../adminguide/enabling-https-to-routers.html) on the Router.
 
1. Click **Save**.