Loading a Windows Identity Foundation thumbprint key with a custom ConfurationBasedIsserNameRegistry class. If you have hidden control characters in the thumbprint key, this will filter them out, allowing the cert to be accepted by WIF and SSO.

gistfile1.cs

<issuerNameRegistry type="RelyingParty1.CustomIssuerNameRegistry, RelyingParty1">
  <trustedIssuers>          
    <add thumbprint="abcdefghijklmnopqrstuvwxyz1234567890abcd" name="optional name" />
  </trustedIssuers>
</issuerNameRegistry>

using System.IdentityModel.Tokens;
using System.Linq;
using System.Text.RegularExpressions;
using System.Xml;

namespace RelyingParty1
{
    public class CustomIssuerNameRegistry : ConfigurationBasedIssuerNameRegistry
    {
        public override void LoadCustomConfiguration(XmlNodeList customConfiguration)
        {
            if (customConfiguration != null && customConfiguration.Count > 0)
            {
                for (int i = 0; i < customConfiguration.Count; i++)
                {
                    var nd = customConfiguration.Item(0);
                    foreach (var add in nd.ChildNodes.Cast<XmlNode>().Where(e => !(e is XmlComment)))
                    {
                        var thumbprint = add.Attributes.Cast<XmlNode>().FirstOrDefault(e => e.Name == "thumbprint");
                        if (thumbprint != null)
                        {
                            var rgx = new Regex("[^a-zA-Z0-9 -]");
                            thumbprint.Value = rgx.Replace(thumbprint.Value, "");
                        }
                    }
                }
            }

            base.LoadCustomConfiguration(customConfiguration);
        }
    }
}