private String buildMetadataGeneratorParameters(final Pair<String, String> signing,
                                                    final Pair<String, String> encryption,
                                                    final Optional<SamlRegisteredService> registeredService) throws Throwable {

        val signingCert = SamlIdPMetadataGenerator.cleanCertificate(signing.getKey());
        val encryptionCert = SamlIdPMetadataGenerator.cleanCertificate(encryption.getKey());

        val idp = configurationContext.getCasProperties().getAuthn().getSamlIdp();
        try (val writer = new StringWriter()) {
            val resolver = SpringExpressionLanguageValueResolver.getInstance();
            val entityId = resolver.resolve(idp.getCore().getEntityId());
            val scope = resolver.resolve(configurationContext.getCasProperties().getServer().getScope());

            val metadataCore = idp.getMetadata().getCore();
            val context = IdPMetadataTemplateContext.builder()
                .encryptionCertificate(encryptionCert)
                .signingCertificate(signingCert)
                .entityId(entityId)
                .scope(scope)
                .endpointUrl(getIdPEndpointUrl())
                .ssoServicePostBindingEnabled(metadataCore.isSsoServicePostBindingEnabled())
                .ssoServicePostSimpleSignBindingEnabled(metadataCore.isSsoServicePostSimpleSignBindingEnabled())
                .ssoServiceRedirectBindingEnabled(metadataCore.isSsoServiceRedirectBindingEnabled())
                .ssoServiceSoapBindingEnabled(metadataCore.isSsoServiceSoapBindingEnabled())
                .sloServicePostBindingEnabled(metadataCore.isSloServicePostBindingEnabled())
                .sloServiceRedirectBindingEnabled(metadataCore.isSloServiceRedirectBindingEnabled())
                .errorUrl(StringUtils.appendIfMissing(getIdPEndpointUrl(), "/error"))
                .build();

            val template = configurationContext.getVelocityEngine()
                .getTemplate("/template-idp-metadata.vm", StandardCharsets.UTF_8.name());

            val velocityContext = new VelocityContext();
            velocityContext.put("context", context);
            template.merge(velocityContext, writer);
            var metadata = writer.toString();

            val customizers = configurationContext.getApplicationContext()
                .getBeansOfType(SamlIdPMetadataCustomizer.class).values();
            if (!customizers.isEmpty()) {
                val openSamlConfigBean = configurationContext.getOpenSamlConfigBean();
                val entityDescriptor = SamlUtils.transformSamlObject(openSamlConfigBean, metadata, EntityDescriptor.class);
                customizers.stream()
                    .sorted(AnnotationAwareOrderComparator.INSTANCE)
                    .forEach(customizer -> customizer.customize(entityDescriptor, registeredService));
                metadata = SamlUtils.transformSamlObject(openSamlConfigBean, entityDescriptor).toString();
            }
            writeMetadata(metadata, registeredService);
            return metadata;
        }
    }
Build metadata generator parameters by passing the encryption,
signing and back-channel certs to the parameter generator.

@param signing           the signing
@param encryption        the encryption
@param registeredService registered service
@return the metadata
support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/idp/metadata/generator/BaseSamlIdPMetadataGenerator.java