Re: How do I change the certificate of a Shibboleth service provider?

[CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)]

I would have, but Stackoverflow provides nice formatting which would have made the question very difficult to read in a plain text email list, and a messy post is not polite to anyone.

What is my false premise? 
Why shouldn't I change the certificate? 
What do you think I want it to mean?

How do I tell if my SP is not using the certificate? It certainly appears as though the SP is using it. I have multiple credential resolvers:

        <CredentialResolver keyName="Active" type="File" key="D:/Packages/Apache2.2/certs/cms.key" certificate="D:/Packages/Apache2.2/certs/cms.crt"/> <!-- old cert -->
        <CredentialResolver keyName="Standby" type="File" key="D:/tmp/sp-key-qa.pem" certificate="D:/tmp/sp-cert-qa.pem"/> <!-- new cert -->


Plus, I copied the certificate metadata directly from Shibboleth itself:
https://sp-qa-machine01/Shibboleth.sso/Metadata

How do I know if the metadata is accurate? I copied and pasted the relevant KeyDescriptor section, and have double and triple checked. 

How do I specify a rule in the IP to use the new certificate? Are you referring to Attribute rules?

I did 're-order' the certificates in the metadata, because I commented out the first SP certificate so only the new SP certificate would be visible in the metadata.