anchor.diff:  
   Your Kill Bill installation is ready to go!
   
  -== Initial Testing
  -
  -You can now login to KAUI from your browser using the URL https://INSTANCE_IP:443, where INSTANCE_IP is the IPV4 address for your instance, given on your dashboard as *Public IPV4 Address*. This should display the KAUI login screen. For an introduction to KAUI, see our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide. The default credentials are: `admin` / `password`. The first few requests might be a bit slow as Kill Bill initializes itself.
  -
  -You can also login in directly to your instance from a terminal or command window. You may have no need to do this for a while, but you should try it and make sure it works. You may need to do this for system monitoring or troubleshooting later.
  +== Testing
  +
  +You can now login to KAUI from your browser using the URL http://INSTANCE_IP:443, where INSTANCE_IP is the IPV4 address for your instance, given on your dashboard as *Public IPV4 Address*. This should display the KAUI login screen. For an introduction to KAUI, see our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide. The default credentials are: `admin` / `password`. The first few requests might be a bit slow as Kill Bill initializes itself.
  +
  +In addition, you can login to the Kill Bill server using the URL http://INSTANCE_IP:8443. This provides access to certain detailed reports that may be needed for maintenance, including metrics, event logs, and the Swagger API pages.
  +
  +== Login to your Instance
  +
  +You have setup access to port 22 in your security group. This will allow you to login directly to your instance from a terminal or command window. You will need to do this to perform some maintenance tasks that will be described below.
   
   To login, use the secure shell command:
   
  
positive.code:    version of this certificate in the future, simply run certbot again
     with the "certonly" option. To non-interactively renew *all* of
     your certificates, run "certbot renew"
   - If you like Certbot, please consider supporting our work by:
  
     Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
     Donating to EFF:                    https://eff.org/donate-le
  ```
  
  Of course, there are a few things that could go wrong:
  
  [1]. `certbot` will attempt to validate your CNAME through your domain provider. If the CNAME does not link correctly to the public DNS name for your AWS instance, the certificate will not be created.
  
  [2]. You could get a message like:
  
  `Error creating new order : Cannot issue for ec2-18-234-168-57.compute-1.amazonaws.com: The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  
  This could happen if you have tried to use your public DNS name directly as your CNAME, which is not allowed.
  
  
  [3]. You could get a message like `certificate cannot be installed`.
  
  For help with these and other problems, try the `certbot` https://certbot.eff.org/help/[help page].
  
  
  When your certificate is installed, you should be able to access KAUI from you browser using `https://` followed by your CNAME as the address. The browser should indicate that the site is secure.
  
  
negative.code: 
  The first time you login, you will see a warning message asking if you want to add this host to your list of hosts. You should answer `yes`.
  
  You will now be able to explore your instance and perform various configuration and maintenance tasks. To exit from your login, type `exit`.
  
  == Kill Bill Configuration
  
  Kill Bill global properties are defined in `/var/lib/killbill/config/killbill.properties`. For example, this is where you can change the MySQL credentials. Take a look at our https://docs.killbill.io/latest/userguide_configuration.html[configuration guide] for more details.
  
  This is also where you can change the default Kill Bill admin credentials: specify `org.killbill.security.shiroResourcePath=/var/lib/killbill/config/shiro.ini` and create the `shiro.ini` file accordingly (see our https://docs.killbill.io/latest/user_management.html[RBAC guide] for more details).
  
  
  == Using HTTPS
  
  === Adding a Certificate
  
  By default, accessing KAUI from a web browser will show that the site is *Not Secure*. You may even see an initial page requiring you to approve a security exception before you can access the site. In order to make the site secure, you will need to add a valid X.509 SSL/TLS certificate.
  
  The easiest option to add the certificate is to make use of the tool `certbot`, which relies on the free Certificate Authority (CA) `Let’s Encrypt`. This method provides an easy way to obtain and install free certificates.
  
  `Certbot` is pre-installed in the latest Kill Bill AMI, but if you need a different version of `certbot`, this is also available through the new package manager `snap`. This package manager is also preinstalled in the Kill Bill AMI.
  
  To setup your certificate, perform the following steps:
  
  ==== 1. Create a CNAME
  
  To create your certificate, you must first setup a *CNAME*, or Canonical Name, based on a verified domain that you own (this is *not* an AWS domain). If you do not have a domain, you can obtain one for free, or very low cost, from an online source such as GoDaddy. The CNAME is part of your domain's DNS profile, and your domain provider should have instructions for creating it.
  
  The CNAME will link your domain to your EC2 instance. If your domain is `mydomain.com` your CNAME might look like `kaui.mydomain.com`. To set this up your domain provider will have you link the name `kaui` to your EC2 instance using its public DNS name.
  
  ==== 2. Add your CNAME to the `nginx` configuration file
  
  First, login to your EC2 instance as described above.
  
  Next, using a text editor of your choosing, edit the file `/etc/nginx/sites-enabled/killbill.conf`. You will need to use `sudo` to edit this file.
  
  This file contains two server blocks. The second block contains the lines:
  
  