How do I change the certificate of a Shibboleth service provider?

[CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)]

> The order in the metadata doesn't, AFAIK, matter.  If you commented  
out the first SP certificate without modifying the SP's configuration  
so that it's using the new certificate, then the behavior you  
experience is exactly what I would expect.

Thanks Nate. I was under the impression that the IDP picked and chose which certificate it used for encrypting, and that the SP must be ready to decrypt with any certificate that was currently in the metadata, based on the information I found here:

https://www.switch.ch/aai/docs/shibboleth/SWITCH/sp-certificate-rollover.html

Since I controlled the metadata file on the IDP, I thought I could just comment it out and the IDP would not use it when talking to the SP. 

I guess it's the other way around, and the SP sends encrypted messages to the IDP instead.