protected function _findIssuers(Certificate $target,
        CertificateBundle $bundle): array
    {
        $issuers = array();
        $issuer_name = $target->tbsCertificate()->issuer();
        $extensions = $target->tbsCertificate()->extensions();
        // find by authority key identifier
        if ($extensions->hasAuthorityKeyIdentifier()) {
            $ext = $extensions->authorityKeyIdentifier();
            if ($ext->hasKeyIdentifier()) {
                foreach ($bundle->allBySubjectKeyIdentifier(
                    $ext->keyIdentifier()) as $issuer) {
                    // check that issuer name matches
                    if ($issuer->tbsCertificate()
                        ->subject()
                        ->equals($issuer_name)) {
                        $issuers[] = $issuer;
                    }
                }
            }
        }
        return $issuers;
    }