A certificate verification issue when get the public key used to verify JWT.

Hi, we are a research group to help developers build secure applications. We designed a cryptographic misuse detector on Java language(Our main concern is the secure implementation and use of Json Web Token). We found your great public repository (i.e., [microservice_arch_springcloud](microservice_arch_springcloud) from Github, and a security issue detected by our detector are shown in the following. The specific security issues we found are as follows:
(1) Location: Package: **com.github.fenixsoft.bookstore.infrasturcture.security**; Class: **RSA256PublicJWTAccessToken.class**
Security issue: not verify the public key certificate used to validate JWT signature.

We detected that the **RSA256PublicJWTAccessToken** method get public key from the certificate without any verification. An attacker may use the private key corresponding to a revoked or expired or self-signed public key certificate to forge a JWT. We recommend to verify the validity of certificates and certificate chains to improve system security.

We wish the above security issues cloud truly help you to build a secure application. If you have any concern or suggestion, please feel free to contact us, we are looking forwart to your reply. Thanks.