anchor.diff:  
   Increasingly, modern browsers require valid certificates when accessing sites using the HTTPS protocol. It may be difficult or impossible to access these sites if a valid certificate is not found.
   
  -The details of the structure of certificates are defined by international standards and are well beyond the scope of this discussion. One thing you need to understand, though, is the certificate authority. Normally this is either an organization that is intrinsically well-known and trusted, such as DigiCert or GlobalSign (called a *root* CA), or an organization in the *trust hierarchy* derived from a root. A CA in a trust hierarchy must be itself certified by another CA in a chain which eventually leads to the root CA. Your CA, in turn, must be able to certify that *you* are who you say you are!
  +The details of the structure of certificates are defined by international standards and are well beyond the scope of this discussion. For more details see the https://en.wikipedia.org/wiki/X.509[Wikipedia article]. One thing you need to understand, though, is the certificate authority. Normally this is either an organization that is intrinsically well-known and trusted, such as DigiCert or GlobalSign (called a *root* CA), or an organization in the *trust hierarchy* derived from a root. A CA in a trust hierarchy must be itself certified by another CA in a chain which eventually leads to the root CA. Your CA, in turn, must be able to certify that *you* are who you say you are!
   
   For temporary use, you can sometimes create a *self-signed* certificate, in which you are your own CA. Most browsers will frown on this, since you are simply vouching for yourself, but it may allow you to get started with security.
   
  
positive.code: 
  === CNAMEs
  
  A CNAME, or *Canonical Name*, is an identifier that links your CA to the resources that you are protecting with your certificate. For Kill Bill you will be protecting public access to KAUI and to the server through the load balancer, identified by its DNS name. The CNAME will link your domain to the appropriate load balancer. If your domain is `mydomain.com` your CNAME might look like `kaui.mydomain.com`. The CNAME is part of your domain's DNS profile, and your domain provider should have instructions for setting it up.
  
  === Protocol and Port Setup
  
  Your AWS security group(s) by default provide rules giving access to KAUI and Kill Bill using the HTTP protocol and a specified port number. For HTTPS you will need additional rules with the new protocol and a new port number.   
  
  === Validation
  
  
negative.code: 
  == Obtaining a Certificate
  
  There are many ways to obtain a certificate that you can use to protect a particular resource. Here we will describe three that may be of use in particular Kill Bill scenarios running on AWS. These are:
  
  1. Creating a self-signed certificate
  2. Using the AWS Certificate Manager
  3. Using the free CA *Let's Encrypt*
  
  === Self-Signed Certificates
  
  The quickest and easiest way to create a certificate is to sign it yourself. In this way you become your own CA. A self-signed certificate should be considered temporary. It will provide encryption, but it cannot prove the identity of your service because you are vouching for yourself. Most browsers will complain or require extra steps to use your system, and some may not allow its use at all.
  
  Since you are acting as your own CA, a self-signed certificate does not require a CNAME. One simple way to create a self-signed certificate is to use the free command line program `openssl`. This program is usually preloaded in Linux and Macintosh environments, and can be downloaded for Windows.
  
  