Cover chainMatchesIssuer() no-PEM-block path

Author: bashgeek

tests/Unit/Endpoints/EndpointsTest.php

@@ -1535,6 +1535,19 @@ function certOrderData(): OrderData
     expect($parsed['subject']['CN'])->toBe('Default Root CA');
 });
 
+it('chainMatchesIssuer() returns false when caBundle has no PEM certificate blocks', function () {
+    $cert   = makeEndpointApi(endpointMock(), withKeyStorage())->certificate();
+    $method = new \ReflectionMethod($cert, 'chainMatchesIssuer');
+
+    $bundle = new \CoyoteCert\DTO\CertificateBundleData(
+        certificate: '',
+        fullchain: '',
+        caBundle: 'not-a-pem-block',
+    );
+
+    expect($method->invoke($cert, $bundle, 'ISRG Root X1'))->toBeFalse();
+});
+
 it('Certificate::getBundle() handles multiple Link headers (comma-separated) and selects matching chain', function () {
     $storage          = withKeyStorage();
     $primaryBundle    = makeCertBundle('Default Root CA');