using cert in SP metadata for encryption

[Tom Scavo]

On Thu, Nov 17, 2016 at 3:39 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
> I've been given metadata for vended service that contains an X509
> certificate, but the IdP (v2) does not see it as an encryption key (sends a
> SAML status indicating failure to encrypt, with logs indicating no key
> encryption credential found for the entity).
>
> The vendor tells me they have "encryption turned on" and confirmed the
> metadata. The certificate in the metadata however is fully contained within
> <ds:Signature...>...</ds:Signature>. Can / should such a cert be used by the
> IdP to encrypt the SAML response?

Is there a use="signing" attribute on the KeyDescriptor? If so, the
key is not an encryption key.

Tom