How do I change the certificate on an IDP web server?

[CHLOE SOWERS (BLOOMBERG/ 731 LEXIN)]

Ok, I didn't realize there was another port 8443. However, I tried to telnet to that port on the IDP
and it didn't connect. Where is the setting for that port? I tried to grep all of shib-idp/conf/*
and could not find any files that reference 8443. I don't think that port (or any other) is 
protected by the web server, because Apache only listens to the SSL port 443 (and 80).

I thought that since the IDP didn't care about the SP's web server certificate, and it doesn't 
perform any verification other than with metadata, then the SP wouldn't care about the IDP's 
web server certificate either, and would only use metadata. Why make it so that the IDP
only verifies via metadata, but the SP verifies by metadata AND a web server certificate?


How would I add the web server certificate to the IDP metadata? The SP fetches the IDP's
metadata via HTTP and saves it into a file. I see multiple 
    <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
with different ids in relying-party.xml. Would I add the web server cert/key there? 
What would I use for id? The id seems to be matched to the 
    <rp:DefaultRelyingParty provider="urn:company:sso:idp"
                         defaultSigningCredentialRef="IdPCredential">
Not only that, but I also see this, which is confusing. It's not clear if adding the 
web server certificate to this file will publish it to the SP.
        <!-- Load the IdP's own metadata.  This is necessary for artifact support. -->
        <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:ResourceBackedMetadata$
            <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/bb$
        </metadata:MetadataProvider>


D:\tmp>telnet sso.dev.company.com 8443
Connecting To sso.dev.company.com...Could not open connection to the host, on
port 8443: Connect failed