INCLUDE THIS SECTION INSIDE CONFIGURATION FILE OF WCF SERVICE / CLIENT APPLICATION. 
IF ALREADY A SIMILAR SECTION IS AVAILABLE, THEN DELETE THE EXISTING SECTION FIRST.
SET VALUE OF 'initializeData' UNDER '<sharedListeners>' TO POINT AT AN ABSOLUTE FOLDER PATH. EXAMPLE : C:\TEMP\app_messages.svclog
===================================================================================================================================

    <system.diagnostics>
        <sources>
            <source name="System.ServiceModel.MessageLogging" switchValue="Verbose,ActivityTracing">
                <listeners>
                    <add type="System.Diagnostics.DefaultTraceListener" name="Default">
                        <filter type="" />
                    </add>
                    <add name="ServiceModelMessageLoggingListener">
                        <filter type="" />
                    </add>
                </listeners>
            </source>
            <source name="System.ServiceModel" switchValue="Verbose,ActivityTracing"
                propagateActivity="true">
                <listeners>
                    <add type="System.Diagnostics.DefaultTraceListener" name="Default">
                        <filter type="" />
                    </add>
                    <add name="ServiceModelTraceListener">
                        <filter type="" />
                    </add>
                </listeners>
            </source>
        </sources>
        <sharedListeners>
            <add initializeData="web_messages.svclog"
                type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                name="ServiceModelMessageLoggingListener" traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, ProcessId, ThreadId, Callstack">
                <filter type="" />
            </add>
            <add initializeData="web_tracelog.svclog"
                type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                name="ServiceModelTraceListener" traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, ProcessId, ThreadId, Callstack">
                <filter type="" />
            </add>
        </sharedListeners>
    </system.diagnostics>

THIS PART WILL GO INSIDE <system.servicemodel> SECTION
=============================================================================================
    <diagnostics>
      <messageLogging logEntireMessage="true" logMalformedMessages="true"
        logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true"
        maxSizeOfMessageToLog="52428800" />
    </diagnostics>

EXAMPLE :
=========
<system.serviceModel>
        <diagnostics>
            <messageLogging logEntireMessage="true" logMalformedMessages="true"
                logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true"
                maxSizeOfMessageToLog="26214445" />
        </diagnostics>
        <bindings>
    .
    .

INCLUDE THIS SECTION INSIDE CONFIGURATION FILE OF WCF SERVICE / CLIENT APPLICATION. 
IF ALREADY A SIMILAR SECTION IS AVAILABLE, THEN DELETE THE EXISTING SECTION FIRST.
SET VALUE OF 'initializeData' UNDER '<sharedListeners>' TO POINT AT AN ABSOLUTE FOLDER PATH. EXAMPLE : C:\TEMP\web_tracelog.svclog
===================================================================================================================================

  <system.diagnostics>
    <sources>
      <source name="System.ServiceModel" switchValue="Verbose,ActivityTracing"
        propagateActivity="true">
        <listeners>
          <add type="System.Diagnostics.DefaultTraceListener" name="Default">
            <filter type="" />
          </add>
          <add name="ServiceModelTraceListener">
            <filter type="" />
          </add>
        </listeners>
      </source>
    </sources>
    <sharedListeners>
      <add initializeData="web_tracelog.svclog"
        type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
        name="ServiceModelTraceListener" traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, ProcessId, ThreadId, Callstack">
        <filter type="" />
      </add>
    </sharedListeners>
  </system.diagnostics>

https://docs.microsoft.com/en-us/dotnet/framework/wcf/diagnostics/tracing/recommended-settings-for-tracing-and-message-logging

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.diagnostics>
    <sources>
      <source name="System.ServiceModel" switchValue="Verbose, ActivityTracing" propagateActivity="true" >
        <listeners>
          <add name="xml"/>
        </listeners>
      </source>
      <source name="System.ServiceModel.MessageLogging">
        <listeners>
          <add name="xml"/>
        </listeners>
      </source>
      <source name="System.Net">
        <listeners>
          <add name="System.Net"/>
        </listeners>
      </source>
      <source name="System.Net.HttpListener">
        <listeners>
          <add name="System.Net"/>
        </listeners>
      </source>
      <source name="System.Net.Sockets">
        <listeners>
          <add name="System.Net"/>
        </listeners>
      </source>
      <source name="System.Net.Cache">
        <listeners>
          <add name="System.Net"/>
        </listeners>
      </source>
    </sources>
    <sharedListeners>
      <add name="xml"
               type="System.Diagnostics.XmlWriterTraceListener"
                     initializeData="C:\temp\WCFTraces.svclog" />
      <add name="System.Net" type="System.Diagnostics.TextWriterTraceListener"
      initializeData="c:\temp\SNtrace.log" traceOutputOptions = "DateTime" />
    </sharedListeners>

    <switches>
      <add name="System.Net" value="Verbose" />
      <add name="System.Net.Sockets" value="Verbose" />
      <add name="System.Net.Cache" value="Verbose" />
      <add name="System.Net.HttpListener" value="Verbose" />
    </switches>

  </system.diagnostics>
  <system.serviceModel>
    <diagnostics>
      <messageLogging logEntireMessage="true" logMalformedMessages="true"
          logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" />
    </diagnostics>
  </system.serviceModel>
</configuration>

So eventually we try to read the current token associated with the request
string thumbprint = x509SecurityToken.Certificate.Thumbprint

And then compare it with the config file entry for our project.
string text = this._configuredTrustedIssuers[thumbprint];

Two checks done:
===========
1. Validate if the existing request security token's thumbprint is already present inside the in memory dictionary object
this._configuredTrustedIssuers.

2. If it is not there, we return Null.
3. If it is there, we compare the  subject name of incoming token with in memory value and pass from there..

All these check are to make sure that we receive the request signed from same issuer which was initially trusted on the main app.


Solution:
To solve this error we need to make sure we have added proper key inside the Federated app configuration file to respective issuer.

If the thumbprint used here is invalid and does not match with the incoming Token - Base 4 encoded value. It fails!


Solution:
To get it working, we would need to extract and use the correct thumbprint.

1. Check the Base 64 encoded value of incoming request via fiddler or Freb logs and find the correct Signing Cert at STS. Get the thumbprint.
2. Use below code to create Thumbprint out of base 64 encoded value.

I hope this helps everyone stuck with same error.

Thanks
Saurabh Somani

WCF does have these hard coded values..
TlsSspiNegotiation tlsNegotiation = new TlsSspiNegotiation(String.Empty, SchProtocols.Ssl3Client | SchProtocols.TlsClient, clientCertificate);
     internal enum SchProtocols
    {
        Zero = 0,
        Ssl2Client = 0x00000008,
        Ssl2Server = 0x00000004,
        Ssl2 = (Ssl2Client | Ssl2Server),
        Ssl3Client = 0x00000020,
        Ssl3Server = 0x00000010,
        Ssl3 = (Ssl3Client | Ssl3Server),
        TlsClient = 0x00000080,
        TlsServer = 0x00000040,
        Tls = (TlsClient | TlsServer),
        Ssl3Tls = (Ssl3 | Tls),
    };

Problem documentation and plan for fix:
Problem will be addressed and fixed in new framework release 4.7
https://github.com/Microsoft/dotnet-apiport/pull/395
https://github.com/Microsoft/dotnet/blob/master/releases/net47/dotnet47-changes.md#wcf

Workaround for existing framework 4.6.2
1. Add the configuration file setting: 
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <startup>
 <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6" />
 </startup>
 <runtime>
 <AppContextSwitchOverrides value="Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols=false" />
 </runtime>
</configuration>

2. Get the private DLL from following location:
https://1drv.ms/f/s!ArgnWb8iHXB6gqRCG5I4nCw1vWbz8g 

3. Path to copy them:
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\
And
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\


More details:
Private build is added with support for TLS 1.1 and TLS 1.2 protocol.

I have tested the above private DLL for self host WCF service, but got new error when testing against IIS hosted WCF service.

Error for IIS hosted WCF Service:

Workaround:
We can try to set the "EstablishSecurityContext" and "NegotiateServiceCredentials" to false at Message Security level and it should help us use WCF message security over TLS 1.1 / 1.2 protocol.
<message clientCredentialType="Certificate" establishSecurityContext="false"  negotiateServiceCredential="false" />

negotiateServiceCredential:
A Boolean value that specifies whether the service credential is provisioned at the client out of band, or is obtained from the service to the client through a process of negotiation. Such a negotiation is a precursor to the usual message exchange.
If the clientCredentialType attribute equals to None, Username, or Certificate, setting this attribute to false implies that the service certificate is available at the client out of band and that the client needs to specify the service certificate (using the <serviceCertificate>) in the <serviceCredentials> service behavior. 
This mode is interoperable with SOAP stacks which implement WS-Trust and WS-SecureConversation.

If the ClientCredentialType attribute is set to Windows, setting this attribute to false specifies Kerberos based authentication. 
This means that the client and service must be part of the same Kerberos domain. This mode is interoperable with SOAP stacks which implement the Kerberos token profile (as defined at OASIS WSS TC) as well as WS-Trust and WS-SecureConversation.

***When this attribute is true, it causes a .NET SOAP negotiation that tunnels SPNego exchange over SOAP messages. The default is true.


I hope this information helps to use WCF Message security correctly with TLS protocol.

Thanks
Saurabh Somani