anchor.diff:  
   == Overview
   
  -Single AMI deployments are a way to deploy the Kill Bill stack, that is both the Kill Bill server and the administrative UI (KAUI), from one AMI. We offer two options. The `Single-Tier` option uses only a single `ec2` instance. This is suitable for testing and experiments. The `Multi-Tier` option uses two or more `ec2` instances, and is designed for production deployments. Both of these deployment options rely on the same underlying AMI, but for the `Multi-Tier` option there is a list of prerequisites, such as an external database, along with a startup script to be provided when launching the instance.
  +Single AMI deployments are a way to deploy the Kill Bill stack, that is both the Kill Bill server and the administrative UI (KAUI), from one AMI. We offer two options. The `Single-Tier` option uses only a single EC2 instance. This is suitable for testing and experiments. The `Multi-Tier` option uses two or more EC2 instances, and is designed for production deployments. Both of these deployment options rely on the same underlying AMI, but for the `Multi-Tier` option there is a list of prerequisites, such as an external database, along with a startup script to be provided when launching the instance.
   
   
   == Single-Tier Deployments
  
positive.code: 
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/single-tier-ami_deployment.png[align=center]
  
  In this model, the Kill Bill server and KAUI are deployed within the Tomcat application server. Requests are handled by `nginx`. Requests received on port 443 are delivered to KAUI, and those received on port 8443 are delivered to Kill Bill. Both Kill Bill and KAUI communicate as needed with the `mysql` database.  
  
  === Getting Started
  
  In order to get started, follow the instructions below:
  
  . Start the installation process by going to +++<a href="https://aws.amazon.com/marketplace/pp/B083LYVG9H?ref=_ptnr_doc_" onclick="getOutboundLink('https://aws.amazon.com/marketplace/pp/B083LYVG9H?ref=_ptnr_doc_'); return false;">AWS Marketplace</a>+++: 
  
  You should see the following image at the top of your screen.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/single-ami-subscribe.png[align=center]
  
  
negative.code: 
  === SSL Certificates
  
  We have configured `nginx` to listen to port `443` (and forward traffic to KAUI). By default, accessing the service from a web browser will show a `Not Secure` site. In order to make the site secure, you will need to add a valid certificate. The easiest option to add the certificate is to rely on `Let’s Encrypt`, a Certificate Authority (CA) that provides an easy way to obtain and install free TLS/SSL certificates.
  
  The steps to add the certifcate are fairly simple and rely on a tool called `certbot`.
  
  [1]. Verify `certbot` is installed or install it
  
  Our latest image should include `certbot` by default, but if not this can be added using the following:
  
  ```
  # Install certbot if not already present
  sudo add-apt-repository -y ppa:certbot/certbot
  sudo apt install -y python-certbot-nginx
  ```
  
  [2]. Stop all services
  
  `certbot` will need to have access to port `80` and `443`
  
  ```
  # Stop kaui
  > sudo service kaui stop
  # Stop killbill
  > sudo service killbill stop
  # Stop nginx
  > sudo service nginx stop
  ```
  
  Make sure your AWS security groups allow incoming traffic on port `80` and port `443` for all IPs 
  
  [3]. Setup your domain’s CNAME Record to point to the public DNS of your EC2 instance.
  
  Create a `CNAME` to map your public DNS -- e.g `https://ec2-18-234-168-57.compute-1.amazonaws.com` -- to a legit `CNAME`, otherwise `certbot` will fail with the following error: `Error creating new order :: Cannot issue for "ec2-18-234-168-57.compute-1.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  
  The configuration of your CNAME needs to happen from the UI of your domain provider (`Namecheap`, `Cloudflare`, ...)
  
  