anchor.diff:     /etc/letsencrypt/live/deployment.killbill.io/fullchain.pem
      Your key file has been saved at:
      /etc/letsencrypt/live/deployment.killbill.io/privkey.pem
  -   Your cert will expire on 2020-05-11. To obtain a new or tweaked
  +   Your cert will expire on 2021-07-11. To obtain a new or tweaked
      version of this certificate in the future, simply run certbot again
      with the "certonly" option. To non-interactively renew *all* of
      your certificates, run "certbot renew"
  
positive.code: ```
  This will create two files that are necessary for encryption.
  
  Finally, follow the instructions for your Kill Bill system type to copy these files to your certificate, then install your certificate in your system.
  
  == Using Let's Encrypt (with Certbot)
  
  `Let's Encrypt` is a root CA that is free to use. Certificates based on `Let's Encrypt` can be created using the application `certbot`.
  
  
  
  === Adding a Certificate
  
  By default, accessing KAUI from a web browser will show that the site is *Not Secure*. You may even see an initial page requiring you to approve a security exception before you can access the site. In order to make the site secure, you will need to add a valid X.509 SSL/TLS certificate.
  
  The easiest option to add the certificate is to make use of the tool `certbot`, which relies on the free Certificate Authority (CA) `Let’s Encrypt`. This method provides an easy way to obtain and install free certificates.
  
  `Certbot` is pre-installed in the latest Kill Bill AMI, but if you need a different version of `certbot`, this is also available through the new package manager `snap`. This package manager is also preinstalled in the Kill Bill AMI.
  
  To setup your certificate, perform the following steps:
  
  ==== 1. Create a CNAME
  
  To create your certificate, you must first setup a *CNAME*, or Canonical Name, based on a verified domain that you own (this is *not* an AWS domain). If you do not have a domain, you can obtain one for free, or very low cost, from an online source such as GoDaddy. The CNAME is part of your domain's DNS profile, and your domain provider should have instructions for creating it.
  
  The CNAME will link your domain to your EC2 instance. If your domain is `mydomain.com` your CNAME might look like `kaui.mydomain.com`. To set this up your domain provider will have you link the name `kaui` to your EC2 instance using its public DNS name.
  
  ==== 2. Add your CNAME to the `nginx` configuration file
  
  First, login to your EC2 instance as described above.
  
  Next, using a text editor of your choosing, edit the file `/etc/nginx/sites-enabled/killbill.conf`. You will need to use `sudo` to edit this file.
  
  
negative.code: 
  If the message does not appear, review the above steps carefully. If needed you can also try the `certbot` https://certbot.eff.org/help/[help page].
  
  == Testing and Renewal
  
  When your certificate is installed, you should be able to access KAUI from you browser using `https://` followed by your CNAME as the address. The browser should indicate that the site is secure.
  
  