def validate_and_decode(jwt_bu64, cert_obj):
    """Validate the JWT and return as a dict.

    - JWTs contain a set of values serialized to a JSON dict. This decodes the JWT and
      returns it as a dict.

    Args:
      jwt_bu64: bytes
        The JWT encoded using a a URL safe flavor of Base64.

      cert_obj: cryptography.Certificate
        Public certificate used for signing the JWT (typically the CN cert).

    Raises:
      JwtException: If validation fails.

    Returns:
      dict: Values embedded in the JWT.

    """
    try:
        return jwt.decode(
            jwt_bu64.strip(), cert_obj.public_key(), algorithms=['RS256'], verify=True
        )
    except jwt.InvalidTokenError as e:
        raise JwtException('Signature is invalid. error="{}"'.format(str(e)))