I am trying to manually verify the signature in a JWT using OpenSSL. From jwt.io I know that the public key verifies the signature, but I am not able to reproduce the result using OpenSSL in terminal. What am I missing?
$ cat token.b64url
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ijg1c1ZGNW5Vdl9CS2tiWF9pTUVzTSJ9.eyJpc3MiOiJodHRwczovL3NvYmVyLmV1LmF1dGgwLmNvbS8iLCJzdWIiOiJWTlFFdjZqeFg1Tzl6T0o5ZzJqVW9JN2NzczdxcFg2MEBjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9zb2JlcmFwaS5zb2xzdGFkLmRldi8iLCJpYXQiOjE1OTk2Mjk3ODMsImV4cCI6MTU5OTcxNjE4MywiYXpwIjoiVk5RRXY2anhYNU85ek9KOWcyalVvSTdjc3M3cXBYNjAiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMifQ.XlY8ClqS5TAQPELgnaWIhKqHif7v1DwyL0rSUeFVllx6NMLX7GhuYd6cH_4Qkxj10Sfm2qPIF4J9BEFUuJWrb_NfUuTVuodA41p-I6mnES1N3-4T-tC-ZEPhCEzE1R66M5c00SoRBbPLGUU--m87HpL-CcDE51FcrfXRjQR2o8qJsc0Pb_baRcGXQ6EquM3TW5ZX4XlJ7ErsWPv09Upo1ZO0sdP4c2SS3Agz_H05nOy7ZQh5JTBu9RpRqAs05VuREz1BbiuqDneUkn6rJrBcqHWJI1RrDY7fmYNBWX-c85_hEijnvfL7eg-UMb7A2uMp0_ZiEQSrpHusgkMyW4ZMEQ
# Convert to Base64
$ TOKEN_B64=$(cat token.b64url | tr '-' '+' | tr '/' '_')
# Separate signature from token
$ SIG_B64=$(echo $TOKEN_B64 | cut -d. -f3)
# Base64 decode the signature
$ echo $SIG_B64 | base64 -d > "sig.dat"
# separate body from JWT
$ DAT_B64=$(echo $TOKEN_B64 | cut -d. -f1-2)
# verify signature. (I would expect this call to return "Verification OK")
$ echo $DAT_B64 | openssl dgst -sha256 -verify public_key.pem -signature "sig.dat"
Verification Failure