corrected migration to deal with orphan certificates