This migration depends on certificate being in the system model