...

If the key is not set as the content of the element, use the location attribute to specify the URL where the key can be found. This may be a file:// URL, if the key can be found in a local file.

For an example, see: https://github.com/spring-projects/spring-security-samples/blob/5.8.x/servlet/xml/java/saml2/login-logout/src/main/resources/credentials/rp-private.key

x509-certificate

The certificate to be used to validate a document signed with the private key. The certificate can either be specified in the content of the element, or as a URL.

If the certificate is not set as the content of the element, use the location attribute to specify the URL where the certificate can be found. This may be a file:// URL, if the certificate can be found in a local file.

For an example, see: https://github.com/spring-projects/spring-security-samples/blob/5.8.x/servlet/xml/java/saml2/login-logout/src/main/resources/credentials/rp-certificate.crt

Retrieving CollectionSpace SAML Metadata

...