title: Using x5c cert to verify JWT
body: <p>I'm having a hard time authenticating a token using a x5c. (MS OAuth/Azure) Using jsonwebtoken in Rust. </p>
  
  <p>Below is the code...</p>
  
  <pre class="lang-rust prettyprint-override"><code>// Trying to isolate the problem by only checking the signature. 
  let validation_config = jsonwebtoken::Validation {
      algorithms: vec![jsonwebtoken::Algorithm::RS256],
      leeway: 0,
      validate_exp: false,
      validate_iat: false,
      validate_nbf: false,
      aud: None,
      iss: None,
      sub: None
  };
  let token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIn...";
  let x5c_cert = "MIIDBTCCAe2gAwIBAgIQKOfEJNDyDplBSXKYcM..."; 
  
  let raw_der = base64::decode_config(der, base64::STANDARD).unwrap();
  let d = jsonwebtoken::decode::&lt;MsOAuthPayload&gt;(&amp;token, &amp;raw_der, &amp;validation_config);
  </code></pre>
  
  <p>The above always returns InvalidSignature.</p>
  
  <ul>
  <li>RS265 is the correct algo.</li>
  <li>The cert is correct. I tried it on jwt.io by adding a BEGIN/END cert and it validates fine.</li>
  <li>I used openssl to convert the BEGIN/END pem to DER and the bytes match up from the base 64 decode.</li>
  <li>The key URL is: <a href="https://login.microsoftonline.com/common/discovery/v2.0/keys" rel="nofollow noreferrer">https://login.microsoftonline.com/common/discovery/v2.0/keys</a> but my specific tenant returns the same keys.</li>
  </ul>
  
  <p>Anyone have some insight on what I'm doing wrong here?</p>
  
  <p>Thanks</p>
  
  <p>EDIT: Minimal working example here. <a href="https://pastebin.com/RqqRaKkU" rel="nofollow noreferrer">https://pastebin.com/RqqRaKkU</a></p>