diff --git a/build/extract_cert_locs.xsl b/build/extract_cert_locs.xsl
index 53e0c474..983f7194 100644
--- a/build/extract_cert_locs.xsl
+++ b/build/extract_cert_locs.xsl
@@ -24,7 +24,12 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 	
-	<xsl:template match="//md:ArtifactResolutionService">
+	<!--
+		ArtifactResolutionService endpoints on IdPs are assumed to be
+		authenticated by TLS; those on SPs are assumed to be authenticated
+		using other mechanisms.
+	-->
+	<xsl:template match="//md:IDPSSODescriptor/md:ArtifactResolutionService">
 		<xsl:value-of select="@Location"/>
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
diff --git a/build/extract_nocert_locs.xsl b/build/extract_nocert_locs.xsl
index 99e5dd2c..335e0fc7 100644
--- a/build/extract_nocert_locs.xsl
+++ b/build/extract_nocert_locs.xsl
@@ -31,6 +31,11 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 
+	<xsl:template match="//md:SPSSODescriptor/md:ArtifactResolutionService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+
 	<xsl:template match="text()">
 		<!-- do nothing -->
 	</xsl:template>