private static Credential getEncryptionCredential(final WsFederationConfiguration config) throws Exception {
        LOGGER.debug("Locating encryption credential private key [{}]", config.getEncryptionPrivateKey());
        LOGGER.debug("Parsing credential private key");
        try (val keyStream = config.getEncryptionPrivateKey().getInputStream();
             val br = new BufferedReader(new InputStreamReader(keyStream, StandardCharsets.UTF_8));
             val pemParser = new PEMParser(br)) {
            val privateKeyPemObject = pemParser.readObject();
            val converter = new JcaPEMKeyConverter().setProvider(new BouncyCastleProvider());

            val kp = FunctionUtils.doIf(Predicates.instanceOf(PEMEncryptedKeyPair.class),
                    Unchecked.supplier(() -> {
                        LOGGER.debug("Encryption private key is an encrypted keypair");
                        val ckp = (PEMEncryptedKeyPair) privateKeyPemObject;
                        val decProv = new JcePEMDecryptorProviderBuilder().build(config.getEncryptionPrivateKeyPassword().toCharArray());
                        LOGGER.debug("Attempting to decrypt the encrypted keypair based on the provided encryption private key password");
                        return converter.getKeyPair(ckp.decryptKeyPair(decProv));
                    }),
                    Unchecked.supplier(() -> {
                        LOGGER.debug("Extracting a keypair from the private key");
                        return converter.getKeyPair((PEMKeyPair) privateKeyPemObject);
                    }))
                .apply(privateKeyPemObject);

            val certParser = new X509CertParser();
            LOGGER.debug("Locating encryption certificate [{}]", config.getEncryptionCertificate());
            try (val is = config.getEncryptionCertificate().getInputStream()) {
                certParser.engineInit(is);
                LOGGER.debug("Invoking certificate engine to parse the certificate [{}]", config.getEncryptionCertificate());
                val cert = (X509Certificate) certParser.engineRead();
                LOGGER.debug("Creating final credential based on the certificate [{}] and the private key", cert.getIssuerDN());
                return new BasicX509Credential(cert, kp.getPrivate());
            }
        }

    }
Helper class that does the heavy lifting with the openSaml library.

@author John Gasper
@since 4.2.0
support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java