anchor.diff:  
   [2]. You could get a message like:
   
  -`Error creating new order :: Cannot issue for "ec2-18-234-168-57.compute-1.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  +`Error creating new order : Cannot issue for ec2-18-234-168-57.compute-1.amazonaws.com: The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
   
   This could happen if you have tried to use your public DNS name directly as your CNAME, which is not allowed.
   
  
positive.code: 
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-names-and-password.png[align=center]
  
  WHen the password is setup and confirmed, click `Create Database` in the lower right corner. You will return to the main Databases screen, which should now look like this:
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-database-starting.png[align=center]
  
  This display shows that your database is starting. After a few minutes, the status will change to `Available` (You may need to reload the page to see this). At this time you can click on the database name to get more information, including the full name of the instance.
  
  On the page that appears you should see a panel named `Connectivity and Security`. THe left side of this panel shows the full name of the endpoint, which you will need shortly, and the port number, which is normally 3306.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-connectivity-and-security.png[align=center]
  
  Lastly, on the `Connectivity and Security` panel, locate and click on the link for the default VPC security group. You will need to add an inbound security rule, because the database by default does not allow external access. In the panel for this group, click on `Inbound Rules` and select `Edit Inbound Rules`. Next click on `Add rule`. In the `Type` column select `MYSQL/Aurora`. The port will be set to 3306 automatically. In the `Source` column, click on the search icon and select `0.0.0.0/0'. Finally, click on `Save Rules` in the bottom right. Your database is ready to go.
  
  [2] Edit the configuration script
  
  
negative.code: 
  [4] Create the databases
  
  Kill Bill requires two databases, with the names `killbill` and `kaui`. We provide predefined schemas for these databases.
  
  First you will need to login to *one* of your instances and create the databases. To login, use the secure shell command:
  
  