Skip to main content

Manage your encryption provider in ShareGate Migrate

Learn how to switch from the default DPAPI encryption provider to a certificate-based provider in ShareGate Migrate, and what to know before making the change.

Note: If you can't find the Encryption provider setting, it is because it's in a progressive rollout and isn't yet available to everyone. It should be available to all ShareGate Migrate subscribers by the end of the month.

Use ShareGate Migrate's encryption provider settings to control which provider secures your local application data.

By default, ShareGate Migrate uses Windows Data Protection (DPAPI). If you work in a VM or multi-machine environment, you can switch to a certificate-based provider for more consistent data access across sessions.

About encryption providers

ShareGate Migrate includes two providers. Switching between them is instant. The provider handles the key that secures your data, not the data itself.

  • DPAPI (default): Windows Data Protection, tied to a specific machine. Simple to set up and works for most environments, but not recommended for VMs.

  • Certificate: Uses a static certificate key. Takes more setup, but keeps your data accessible if you work across multiple machines or in a VM.

Why switch from DPAPI to a certificate

DPAPI ties encryption to a specific Windows machine. In VMs and in secured Windows environments, the encryption key can change unexpectedly, making your local ShareGate Migrate data inaccessible.

A certificate-based provider uses a static key that stays consistent across machines and sessions, so your data remains accessible even if you move your database or re-image a machine.

Change your encryption provider

  1. In ShareGate Migrate, go to Settings.

  2. Select Security.

  3. Under Encryption Provider, select Certificate.

  4. Add your certificate using one of the methods below.

Import a certificate

Select Import to validate and install a certificate file into the current user's Windows certificate store.

Use a certificate thumbprint

If your certificate is already installed on the machine, select Thumbprint and enter the certificate's thumbprint. ShareGate Migrate retrieves the certificate automatically, subject to your Windows user access permissions.

Certificate requirements

Your certificate must meet the following requirements before use:

  • Format: PFX / PKCS#12 (.pfx), password-protected

  • Key algorithm: RSA

  • Keys: Must include both public and private keys

Did this answer your question?