Set a certification to be encrypted in its setup. Setting the Advanced encryption key property causes VSys to encrypt all fields other than Effective date and Expiration date to be encrypted. (These two fields are always unencrypted so that you can filter and search by them.) Note that unlike the older encryption tools, you can't encrypt some fields and not others, and you certainly cannot mix and match encryption keys in the same certification.
When working with encrypted certifications, if VSys is unable to decrypt the certification (or has not yet prompted you for a decryption key), it will show like this: