Encrypted SAML token from ADFS

I need your help on how to configure the MVC application so it can accept the encrypted SAML token return by ADFS.

As background, I use ADFS as an identity provider in MVC web app and it works well whenever I register the MVC app as relying party without encryption certificate.

After I add encryption certificate in "Relying party" of ADFS then exception said ID4036: The key needed to decrypt the encrypted security token could not be resolved from the following security key identifier

I tried to change the web.config

<serviceCertificate><certificateReference x509FindType="FindBySubjectDistinguishedName" findValue="CN=xxx.xxxx.com" /></serviceCertificate>

but it still doesn't work.

Thanks, Rahman