public Certificate add(CvCertificate cert) {
        final Certificate db = Certificate.from(cert);

        if (repository.countByIssuerAndSubject(db.getIssuer(), db.getSubject()) > 0) {
            throw new ClientException(String.format(
                "Certificate of subject %s and issuer %s already exists", db.getSubject(), db.getIssuer()));
        }
        // Special case for first CVCA certificate for this document type
        if (db.getType() == Certificate.Type.CVCA
                && repository.countByDocumentTypeAndType(db.getDocumentType(), db.getType()) == 0) {
            signatureService.verify(cert, cert.getBody().getPublicKey(), cert.getBody().getPublicKey().getParams());
            logger.warn("Added first CVCA certificate for {}, set trusted flag manually", db.getDocumentType());
        } else {
            verify(cert);
            if (db.getType() == Certificate.Type.AT) {
                verifyPublicKey(cert);
            }
        }
        return repository.saveAndFlush(db);
    }
@Test
    public void shouldNotAddATIfPublicKeyIsNotFound() throws Exception {
        Mockito.doThrow(new nl.logius.digid.sharedlib.exception.ClientException(
            "Not Found", 404
        )).when(hsmClient).keyInfo(Mockito.eq("AT"), Mockito.eq("SSSSSSSSSSSSSSSS"));

        certificateRepo.save(loadCvCertificate("rdw/acc/cvca.cvcert", true));
        certificateRepo.save(loadCvCertificate("rdw/acc/dvca.cvcert", false));

        ClientException thrown = assertThrows(ClientException.class, () -> service.add(readCvCertificate("rdw/acc/at001.cvcert")));
        assertEquals("Private key of certificate is not inside hsm", thrown.getMessage());
    }