Shibboleth uses x509 certificates.
These are used to encrypt end to end communication between the client and SP with the IdP.
Certificates can also be used for signing and encrypting SAML assertions and authentication if you are using LDAP as your authoritative database.
A browser-facing certificate that users see is used for HTTPS on port 443 and this certificate will need to be renewed periodically.
A certificate is also in place to encrypt the queries between the IdP and the LDAP server and used for authentication using StartTLS or SSL/TLS which is
discussed here on the Microsoft site.