Hi.
It's **idp-signing.crt**, the other one is mostly a legacy stuff as of now and you simply shouldn't touch it or bother with it anymore. You also can always check url like this `https://YOUR.GLUU.HOST/idp/shibboleth` - the certificate(s) which is actually used is published there.