This error can occur when the certificate used to sign the security token cannot be located using the thumbprint specified in the configuation file. The thumbprint is specified in the trustedIssuers element of the issuerNameRegistry element. Make sure that the value of the thumbprint attribute matches exactly the thumbprint of the certificate.
The configuration file is an XML file and must be saved with ASCII or ANSI encoding. Make sure you are viewing and editing the file in an ASCII or ANSI editor, such as Notepad. If the file contains any Unicode characters, additional or invalid characters may be introduced to elements and attributes when rendered as ASCII or ANSI.
See Configuration for details on configuring the various OnBase clients to use AD FS.