public Certificate add(CvCertificate cert) {
        final Certificate db = Certificate.from(cert);

        if (repository.countByIssuerAndSubject(db.getIssuer(), db.getSubject()) > 0) {
            throw new ClientException(String.format(
                "Certificate of subject %s and issuer %s already exists", db.getSubject(), db.getIssuer()));
        }
        // Special case for first CVCA certificate for this document type
        if (db.getType() == Certificate.Type.CVCA
                && repository.countByDocumentTypeAndType(db.getDocumentType(), db.getType()) == 0) {
            signatureService.verify(cert, cert.getBody().getPublicKey(), cert.getBody().getPublicKey().getParams());
            logger.warn("Added first CVCA certificate for {}, set trusted flag manually", db.getDocumentType());
        } else {
            verify(cert);
            if (db.getType() == Certificate.Type.AT) {
                verifyPublicKey(cert);
            }
        }
        return repository.saveAndFlush(db);
    }
@Test
    public void shouldNotAddCertificateIfFirstButInvalidSignature() throws Exception {
        final byte[] der = readFixture("rdw/acc/cvca.cvcert");
        der[461] = 2;

        ClientException thrown = assertThrows(ClientException.class, () -> service.add(mapper.read(der, CvCertificate.class)));
        assertEquals("Invalid signature", thrown.getMessage());
    }