address review comments

Signed-off-by: Steve Sloka <slokas@vmware.com>

design/fallbackcert.md

@@ -3,7 +3,7 @@
 Status: Draft
 
 Contour supports virtual host based routing over TLS and utilizes SNI which allows multiple fqdn's to be used on the same network endpoint.
-Unfortunately, some requests are sent and do not have the HOST header applied. 
+Unfortunately, some requests are sent and do not have the SNI server name set. 
 When this happens, the request fails since the request does not match any routing rules applied to Envoy.
 
 This design doc looks to enable a fallback certificate, such that when a request is received at Envoy, it will still route to the proper set of endpoints even though standard SNI logic isn't applied.
@@ -23,11 +23,12 @@ Contour provides virtual host based routing, so that the TLS request is routed t
 As HOST Header is encrypted during TLS handshake, it can’t be used for virtual host based routing unless client sends HTTPS request specifying hostname using the SNI or the request is first decrypted using a default TLS certificate.
 Some users need to support clients which may not be using SNI.
 When an HTTPS request is received, Envoy needs to first decrypt the request using a default TLS certificate and then based on the HOST header, route it to appropriate service.
-As of now, Contour only provides certificate at virtual host level in an IngressRoute and there is no way to define a default TLS certificate in Contour.
+As of now, Contour only provides certificate at virtual host level in an HTTPProxy and there is no way to define a default TLS certificate in Contour.
 
 ## High-Level Design
 
-Contour will add a new argument to `contour serve` named `--fallback-certificate` which references a secret that is namespaced with a name (e.g. `namespace/name`).
+Contour will add a new argument to `contour serve` named `--fallback-certificate` which references a secret which is namespaced with a name (e.g. `namespace/name`).
+This same configuration will be available in the Contour configuration file in the `tls.fallback-certificate` location.
 Secondly, a new field will be added to the `HTTPProxy.Spec.VirtualHost.TLS` named `FallbackCertificatedEnabled` to allow virtual hosts to opt into this functionality.
 This last point is important as by default, all vhosts will **not** be enabled for this feature.