The AD RMS service account %1 does not have permission to access the certificate store %2. To correct this error, in the ...

The AD RMS service account %1 does not have permission to access the certificate store %2. To correct this error, in the AD RMS console, select Microsoft Federation Gateway Support, and then click Grant Permissions to Token Decryption Certificate on this Server. 

Parameter Reference
Context: %3
Exception: %4