config can be encrypted with {PBE}