anchor.diff:  
   === SSL Certificates
   
  -We have configured `nginx` to listen to port `443` (and forward traffic to KAUI). By default, accessing the service from a web browser will show a `Not Secure` site. In order to make the site secure, you will need to add a valid certificate. The easiest option to add the certificate is to rely on `Let’s Encrypt`, a Certificate Authority (CA) that provides an easy way to obtain and install free TLS/SSL certificates.
  -
  -The steps to add the certifcate are fairly simple and rely on a tool called `certbot`.
  -
  -[1]. Verify `certbot` is installed or install it
  -
  -Our latest image should include `certbot` by default, but if not this can be added using the following:
  -
  -```
  -# Install certbot if not already present
  -sudo add-apt-repository -y ppa:certbot/certbot
  -sudo apt install -y python-certbot-nginx
  -```
  -
  -[2]. Stop all services
  -
  -`certbot` will need to have access to port `80` and `443`
  -
  -```
  -# Stop kaui
  -> sudo service kaui stop
  -# Stop killbill
  -> sudo service killbill stop
  -# Stop nginx
  -> sudo service nginx stop
  -```
  -
  -Make sure your AWS security groups allow incoming traffic on port `80` and port `443` for all IPs 
  -
  -[3]. Setup your domain’s CNAME Record to point to the public DNS of your EC2 instance.
  -
  -Create a `CNAME` to map your public DNS -- e.g `https://ec2-18-234-168-57.compute-1.amazonaws.com` -- to a legit `CNAME`, otherwise `certbot` will fail with the following error: `Error creating new order :: Cannot issue for "ec2-18-234-168-57.compute-1.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  -
  -The configuration of your CNAME needs to happen from the UI of your domain provider (`Namecheap`, `Cloudflare`, ...)
  -
  -[4]. Modify the nginx `killbill.conf` server sections
  -
  -The `server_name` by default specifies `_`. Instead you need to replace this with your `CNAME`:
  +`nginx` is configured to listen on port 443 for messages to be forwarded to KAUI. Port 443 is the standard port for HTTPS. By default, accessing the service from a web browser will show a `Not Secure` site. In order to make the site secure, you will need to add a valid certificate. The easiest option to add the certificate is to make use of the tool `certbot`, which relies on the free Certificate Authority (CA) `Let’s Encrypt`  This method provides an easy way to obtain and install free TLS/SSL certificates.
  +
  +`Certbot` is pre-installed in the latest Kill Bill AMI. However, we now recommend using a different version of `certbot` available through the new package manager `snap`. This package manager is also preinstalled in the Kill Bill AMI.
  +
  +To validate your certificate, you must first setup a CNAME, or Canonical Name, based on a verified domain that you own. If you do not have a domain, you can obtain one for free, or very low cost, from an online source such as GoDaddy. The CNAME is part of your domain's DNS profile, and your domain provider should have instructions for creating it.
  +
  +The CNAME should link your domain to your AWS instance. If your domain is `domain.com` your CNAME might look like `killbill.domain.com`.   
  +
  +
  +To setup your certificate, perform the following steps:
  +
  +[1]. Create a CNAME linking your domain to your AWS instance.
  +
  +[2]. Add your CNAME to the server block in the `nginx` configuration file.
  +
  +Using a text editor of your choosing, edit the file `/etc/nginx/sites-enabled/killbill.conf`. You will need to use sudo to edit this file.
  +
  +This file contains two server blocks. The second block contains the lines:
   
   ```
   server {
       listen 443;
  -    server_name <CNAME>;
  -
  -...
  -```
  -
  -[5]. Run `certbot`
  -
  -```
  -> sudo certbot --nginx -d <CNAME>
  -```
  -
  -If successful you will see a message like:
  -
  -
  -```
  -...
  +    server_name _;
  +```
  +Replace the underscore after `server_name` with your CNAME:
  +
  +```
  +server {
  +    listen 443;
  +    server_name killbill.domain.com;
  +```
  +
  +Save the modified file.
  +
  +[3]. Reload the configuration file with the command:
  +
  +```
  +sudo nginx -s reload
  +```
  +
  +[4]. Enable HTTP traffic on port 80. This is just to allow `certbot` to create your certificate. To do this, go to your EC2 dashboard and add a new inbound rule as follows: Type: HTTP, Protocol: TCP, Port Range: 80, Source: 0.0.0.0/0. Your inbound rules should now look like this:
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/single-ami-inbound-port-80.png[align=center]
  +
  +
  +[5]. Remove the existing `certbot` package:
  +
  +Type the command
  +
  +```
  +sudo apt-get remove certbot
  +```
  +When asked if you want to proceed, type `Y` for yes.
  +
  +[6]. Install `certbot` using `snap`:
  +
  +The following commands will install `certbot` and link it to the `/usr/bin` directory:
  +
  +```
  +sudo snap install --classic certbot
  +sudo ln -s /snap/bin/certbot /usr/bin/certbot
  +```
  +[7].  Run `certbot` to create and install the certificate:
  +
  +```
  +sudo certbot --nginx
  +```
  +If you are asked, confirm the server name to be used. If all goes well, you will see a message like:
  +
  +```
   IMPORTANT NOTES:
    - Congratulations! Your certificate and chain have been saved at:
      /etc/letsencrypt/live/deployment.killbill.io/fullchain.pem
  
positive.code:    Donating to EFF:                    https://eff.org/donate-le
  ```
  
  [6]. Restart all services
  
  ```
  # Start nginx
  > sudo service nginx start
  # Start killbill
  > sudo service killbill start
  # Start kaui
  > sudo service kaui start
  ```
  
  Note: You can edit your security groups and remove the `port` `80`, and also reduce the visibility for other ports by specifying a tighter range of incoming IPs.
  
  The `Let's Encrypt` certifcates are only valid 90 days and will therefore neeed to be renewed. `certbot` will create a cron entry under `/etc/cron.d/certbot` to make this process transparent.
  
  === Kill Bill Properties
  
  
negative.code: To exit the mysql interactive mode, type `exit`.
  
  
  === Nginx
  
  The load balancer `nginx` should normally require little attention. The configuration files are located under `/etc/nginx/. The configuration file for `nginx itself is `/etc/nginx/nginx.conf`. Additional configuration files are located under `/etc/nginx/sites-enabled/`. The only file normally present in this directory is `/etc/nginx/sites-enabled/killbill.conf`. This file may need to be edited to enable SSL, as explained above.
  
  == Upgrades
  
  From time to time new versions of Kill Bill and KAUI may be released. This section explains how to install these new versions.
  
  Note: you must switch to the `tomcat` user first in order to upgrade Kill Bill or Kaui (`sudo su - tomcat`).
  
  The configuration file `/var/lib/killbill/kpm.yml` specifies the Kill Bill version (and its plugins) running on the instance. Once you edit this file to specify the new version number, it will be used automatically. After editing this file, simply run the command `$KPM_INSTALL_KB_CMD`, delete the cached directory `/var/lib/tomcat/webapps/ROOT`, and restart the instance.
  
  A similar process can be used for KAUI: update `/var/lib/kaui/kpm.yml`, run `$KPM_INSTALL_KAUI_CMD`, delete the cached directory `/var/lib/tomcat/webapps2/ROOT` and restart the instance.
  