anchor.diff:  
   The `Let's Encrypt` certifcates are only valid 90 days and will therefore neeed to be renewed. `certbot` will create a cron entry under `/etc/cron.d/certbot` to make this process automatic.
   
  +The ACM certificates will renew automatically.
  +
  +
  +
  
positive.code: ```
  This will create two files that are necessary for encryption.
  
  Finally, follow the instructions for your Kill Bill system type to copy these files to your certificate, then install your certificate in your system.
  
  == Using Let's Encrypt (with Certbot)
  
  `Let's Encrypt` is a root CA that is free to use. Certificates based on `Let's Encrypt` can be created using the application `certbot`.
  
  
  
  === Adding a Certificate
  
  By default, accessing KAUI from a web browser will show that the site is *Not Secure*. You may even see an initial page requiring you to approve a security exception before you can access the site. In order to make the site secure, you will need to add a valid X.509 SSL/TLS certificate.
  
  The easiest option to add the certificate is to make use of the tool `certbot`, which relies on the free Certificate Authority (CA) `Let’s Encrypt`. This method provides an easy way to obtain and install free certificates.
  
  `Certbot` is pre-installed in the latest Kill Bill AMI, but if you need a different version of `certbot`, this is also available through the new package manager `snap`. This package manager is also preinstalled in the Kill Bill AMI.
  
  To setup your certificate, perform the following steps:
  
  ==== 1. Create a CNAME
  
  To create your certificate, you must first setup a *CNAME*, or Canonical Name, based on a verified domain that you own (this is *not* an AWS domain). If you do not have a domain, you can obtain one for free, or very low cost, from an online source such as GoDaddy. The CNAME is part of your domain's DNS profile, and your domain provider should have instructions for creating it.
  
  The CNAME will link your domain to your EC2 instance. If your domain is `mydomain.com` your CNAME might look like `kaui.mydomain.com`. To set this up your domain provider will have you link the name `kaui` to your EC2 instance using its public DNS name.
  
  ==== 2. Add your CNAME to the `nginx` configuration file
  
  First, login to your EC2 instance as described above.
  
  Next, using a text editor of your choosing, edit the file `/etc/nginx/sites-enabled/killbill.conf`. You will need to use `sudo` to edit this file.
  
  
negative.code: 
  Increasingly, modern browsers require valid certificates when accessing sites using the HTTPS protocol. It may be difficult or impossible to access these sites if a valid certificate is not found.
  
  The details of the structure of certificates are defined by international standards and are well beyond the scope of this discussion. For more details see the https://en.wikipedia.org/wiki/X.509[Wikipedia article]. One thing you need to understand, though, is the certificate authority. Normally this is either an organization that is intrinsically well-known and trusted, such as DigiCert or GlobalSign (called a *root* CA), or an organization in the *trust hierarchy* derived from a root. A CA in a trust hierarchy must be itself certified by another CA in a chain which eventually leads to the root CA. Your CA, in turn, must be able to certify that *you* are who you say you are!
  
  For temporary use, you can sometimes create a *self-signed* certificate, in which you are your own CA. Most browsers will frown on this, since you are simply vouching for yourself, but it may allow you to get started with security.
  
  