Azure Access Token - Invalid Signature in Jwt.io

It has been a nightmare. I'm facing problems to verify Azure Access Token Signature using jwt.io. Doesn't matter what I do, the answer is always an invalid signature.

Could someone try to help with this, please?

My Steps:

1. I generated a Token Id and Access Token from the MSAL Java App Example (msal-java-webapp-sample).
2. I get from my Azure Access Token the "kid" from the Access Token header accessing the jwt.io.
3. I access the "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"
4. I open the link "jwks_uri" access from step 3. "https://login.microsofto…f143/discovery/v2.0/keys"
5. I get the kid from step 2 and I find it in the "https://login.microsofto…f143/discovery/v2.0/keys".
6. I copy the "x5c" inside the URL described in step 5.
7. I open the jwt.io.
8. I copy the Access Token retrieved from step 2 and copy it in the Encoded Field.
9. I copy the "x5c" attribute retrieved from step 6 in the first field regarding the Signature. (Layout-1)

----- Layout-1 ----

-----BEGIN PUBLIC KEY----- MIIDBTCCAe2gAwIBAgIQQiR8gZNKuYpH6cP+KIE5ijANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTIwMDgyODAwMDAwMFoXDTI1MDgyODAwMDAwMFowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMkymupuRhTpZc+6CBxQpL0SaAb+8CzLiiDyx2xRoecjojvKN2pKKjIX9cejMSDRoWaOnZCK4VZVX1iYRCWT1WkHb8r1ZpSGa7oXG89zxjKjwG46tiamwdZjJ7Mhh8fqLz9ApucY/LICPMJuu6d56LKs6hb4OpjylTvsNUAa+bHg1NgMFNg0fPCxdr9N2Y4J+Jhrz3VDl4oU0KDZX/pyRXblzA8kYGWm50dh5WB4WoB8MtW3lltVrRGj8/IgTf9GxpBsO9OWgwVByZHU7ctZs7AmUbq/59Ipql7vSM6EsoquXdMiq0QOcZAPitwzHkTKrmeULz0/RHnuBGXxS/e8wX0CAwEAAaMhMB8wHQYDVR0OBBYEFGcWXwaqmO25Blh2kHHAFrM/AS2CMA0GCSqGSIb3DQEBCwUAA4IBAQDFnKQ98CBnvVd4OhZP0KpaKbyDv93PGukE1ifWilFlWhvDde2mMv/ysBCWAR8AGSb1pAW/ZaJlMvqSN/+dXihcHzLEfKbCPw4/Mf2ikq4gqigt5t6hcTOSxL8wpe8OKkbNCMcU0cGpX5NJoqhJBt9SjoD3VPq7qRmDHX4h4nniKUMI7awI94iGtX/vlHnAMU4+8y6sfRQDGiCIWPSyypIWfEA6/O+SsEQ7vZ/b4mXlghUmxL+o2emsCI1e9PORvm5yc9Y/htN3Ju0x6ElHnih7MJT6/YUMISuyob9/mbw8Vf49M7H2t3AE5QIYcjqTwWJcwMlq5i9XfW2QLGH7K5i8 -----END PUBLIC KEY-----

But the result is always the same. Invalid Signature.

In my application I am using this URls.

Request Azure Code Auth
https://login.microsoftonline.com/<Tenant_Id>/oauth2/v2.0/authorize?
client_id=xxxxxx12312xxxxxxxx
&response_type=code
&redirect_uri=http://localhost:8443/<AppName>/secure/aad
&response_mode=query
&scope=openid+profile+offline_access
&state=12345
&prompt=login

---- response ---
localhost:8443/msal4jsample/secure/aad?
code=0.AAAAe7KHdX9Z7oIAA
&amp;state=12345
&amp;session_state=716c6fa7-8b51-4025-98ef-489c3b25ab3d#

Request Azure Tokens

Post Method

https://login.microsoftonline.com/common/oauth2/v2.0/token?
grant_type=authorization_code
&code=<Received from above azure code auth request>
&client_id=<Application_Id Registered in Azure>
&client_secret=<Secret Key>
&scope=openid profile email User.Read
&redirect_uri=http://localhost:8443/<MyApp>/secure/aad


---- Response ----

{
    "token_type": "Bearer",
    "scope": "openid profile User.Read email",
    "expires_in": 3599,
    "ext_expires_in": 3599,
    "access_token": "X1YmQ",
    "refresh_token": "PC6YMqqLpvm",
    "id_token": "Y86JentfTUzBQoiUzav3pAu3GIG3OhslQ"
}

Why when I try to check the "refresh_token": "PC6YMqqLpvm" in www.jwt.io the Signature is invalid.

Please, could you tell me what I'm doing wrong? Do I need to indicate Azure to sign the Access Token?

Note: I've used this tutorial to check the Signature of Access Token. https://blogs.aaddevsup.xyz/2019/03/using-jwt-io-to-verify-the-signature-of-a-jwt-token/

Kind Regards, Mario Rodrigues