About Certificate and Key Resolution Order
At run time, the web service resolves the locations of the certificates and keys it needs for policy assertions by initiating a series of searches. The locations searched depend upon factors such as:

Whether the web service is a provider or consumer

Which policy assertion (for example, signing or encryption) needs the key or certificate

Whether the policy assertion is for an inbound or outbound message

The policy attributes and their settings