code: def _encrypt_assertion(self, encrypt_cert, sp_entity_id, response,
                             node_xpath=None):
          
          _certs = []
  
          if encrypt_cert:
              _certs.append(encrypt_cert)
          elif sp_entity_id is not None:
              _certs = self.metadata.certs(sp_entity_id, "any", "encryption")
          exception = None
          for _cert in _certs:
              try:
                  begin_cert = "-----BEGIN CERTIFICATE-----\n"
                  end_cert = "\n-----END CERTIFICATE-----\n"
                  if begin_cert not in _cert:
                      _cert = "%s%s" % (begin_cert, _cert)
                  if end_cert not in _cert:
                      _cert = "%s%s" % (_cert, end_cert)
                  _, cert_file = make_temp(_cert.encode('ascii'), decode=False)
                  response = self.sec.encrypt_assertion(response, cert_file,
                                                        pre_encryption_part(),
                                                        node_xpath=node_xpath)
                  return response
              except Exception as ex:
                  exception = ex
                  pass
          if exception:
              raise exception
          return response
docs: Encryption of assertions.
  
          :param encrypt_cert: Certificate to be used for encryption.
          :param sp_entity_id: Entity ID for the calling service provider.
          :param response: A samlp.Response
          :param node_xpath: Unquie path to the element to be encrypted.
          :return: A new samlp.Resonse with the designated assertion encrypted.