can do the composite match on issuer to cert
finished out the CertificateValidator logic