anchor.diff:  To exit the mysql interactive mode, type `exit`.
   
   
  -**Nginx**
  -
  -The configuration files are located under `/etc/nginx/` -- e.g `/etc/nginx/sites-enabled/killbill.conf`
  -
  -== Upgrade steps
  +=== Nginx
  +
  +The load balancer `nginx` should normally require little attention. The configuration files are located under `/etc/nginx/. The configuration file for `nginx itself is `/etc/nginx/nginx.conf`. Additional configuration files are located under `/etc/nginx/sites-enabled/`. The only file normally present in this directory is `/etc/nginx/sites-enabled/killbill.conf`. This file may need to be edited to enable SSL, as explained above.
  +
  +== Upgrades
  +
  +From time to time new versions of Kill Bill and KAUI may be released. This section explains how to install these new versions.
   
   Note: you must switch to the `tomcat` user first in order to upgrade Kill Bill or Kaui (`sudo su - tomcat`).
   
  -The configuration file `/var/lib/killbill/kpm.yml` specifies the Kill Bill version (and its plugins) running on the instance. After updating this file with the new version(s), simply execute `$KPM_INSTALL_KB_CMD`, delete the cached directory `/var/lib/tomcat/webapps/ROOT` and restart the instance.
  -
  -A similar process can be used for Kaui: update `/var/lib/kaui/kpm.yml`, run `$KPM_INSTALL_KAUI_CMD`, delete the cached directory `/var/lib/tomcat/webapps2/ROOT` and restart the instance.
  +The configuration file `/var/lib/killbill/kpm.yml` specifies the Kill Bill version (and its plugins) running on the instance. Once you edit this file to specify the new version number, it will be used automatically. After editing this file, simply run the command `$KPM_INSTALL_KB_CMD`, delete the cached directory `/var/lib/tomcat/webapps/ROOT`, and restart the instance.
  +
  +A similar process can be used for KAUI: update `/var/lib/kaui/kpm.yml`, run `$KPM_INSTALL_KAUI_CMD`, delete the cached directory `/var/lib/tomcat/webapps2/ROOT` and restart the instance.
  
positive.code: 
  === SSL Certificates
  
  We have configured `nginx` to listen to port `443` (and forward traffic to KAUI). By default, accessing the service from a web browser will show a `Not Secure` site. In order to make the site secure, you will need to add a valid certificate. The easiest option to add the certificate is to rely on `Let’s Encrypt`, a Certificate Authority (CA) that provides an easy way to obtain and install free TLS/SSL certificates.
  
  The steps to add the certifcate are fairly simple and rely on a tool called `certbot`.
  
  [1]. Verify `certbot` is installed or install it
  
  Our latest image should include `certbot` by default, but if not this can be added using the following:
  
  ```
  # Install certbot if not already present
  sudo add-apt-repository -y ppa:certbot/certbot
  sudo apt install -y python-certbot-nginx
  ```
  
  [2]. Stop all services
  
  `certbot` will need to have access to port `80` and `443`
  
  ```
  # Stop kaui
  > sudo service kaui stop
  # Stop killbill
  > sudo service killbill stop
  # Stop nginx
  > sudo service nginx stop
  ```
  
  Make sure your AWS security groups allow incoming traffic on port `80` and port `443` for all IPs 
  
  [3]. Setup your domain’s CNAME Record to point to the public DNS of your EC2 instance.
  
  Create a `CNAME` to map your public DNS -- e.g `https://ec2-18-234-168-57.compute-1.amazonaws.com` -- to a legit `CNAME`, otherwise `certbot` will fail with the following error: `Error creating new order :: Cannot issue for "ec2-18-234-168-57.compute-1.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  
  The configuration of your CNAME needs to happen from the UI of your domain provider (`Namecheap`, `Cloudflare`, ...)
  
  [4]. Modify the nginx `killbill.conf` server sections
  
  The `server_name` by default specifies `_`. Instead you need to replace this with your `CNAME`:
  
  ```
  server {
      listen 443;
      server_name <CNAME>;
  
  ...
  ```
  
  [5]. Run `certbot`
  
  ```
  > sudo certbot --nginx -d <CNAME>
  ```
  
  If successful you will see a message like:
  
  
  ```
  ...
  IMPORTANT NOTES:
   - Congratulations! Your certificate and chain have been saved at:
     /etc/letsencrypt/live/deployment.killbill.io/fullchain.pem
  
negative.code:    Donating to EFF:                    https://eff.org/donate-le
  ```
  
  Of course, there are a few things that could go wrong:
  
  [1]. `certbot` will attempt to validate your CNAME through your domain provider. If the CNAME does not link correctly to the public DNS name for your AWS instance, the certificate will not be created.
  
  [2]. You could get a message like:
  
  `Error creating new order :: Cannot issue for "ec2-18-234-168-57.compute-1.amazonaws.com": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy`
  
  This could happen if you have tried to use your public DNS name directly as your CNAME, which is not allowed.
  
  
  [3]. You could get a message like `certificate cannot be installed`.
  
  For help with these and other problems, try the `certbot` https://certbot.eff.org/help/[help page].
  
  
  When your certificate is installed, you should be able to access KAUI from you browser using `https://` followed by your CNAME as the address. The browser should indicate that the site is secure.
  
  When your certificate is successfully installed, you can edit your security groups again to remove the access through port 80.
  
  The `Let's Encrypt` certifcates are only valid 90 days and will therefore neeed to be renewed. `certbot` will create a cron entry under `/etc/cron.d/certbot` to make this process automatic.
  
  === Kill Bill Properties
  
  