@Override
    public Resource resolveEncryptionCertificate(final Optional<SamlRegisteredService> registeredService) throws Throwable {
        val metadataDocument = fetch(registeredService);
        if (metadataDocument != null && metadataDocument.isValid()) {
            LOGGER.trace("Fetching encryption certificate resource for metadata document [{}]", metadataDocument.getId());
            return getResource(metadataDocument.getEncryptionCertificate());
        }
        return ResourceUtils.EMPTY_RESOURCE;
    }
This is {@link AbstractSamlIdPMetadataLocator}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/idp/metadata/locator/AbstractSamlIdPMetadataLocator.java