public byte[] generateAtRequest(DocumentType documentType, PolymorphType authorization, String sequenceNo,
                                    String reference) {
        final Certificate dvca = getDvca(documentType);
        final String subject = getAtSubject(documentType, dvca.getSubject(), sequenceNo);
        if (repository.countBySubject(subject) != 0) {
            throw new ClientException("AT certificate of " + subject + " already present");
        }

        final PublicKeyInfo keyInfo = new PublicKeyInfo();
        keyInfo.setOid(EACObjectIdentifiers.id_TA_ECDSA_SHA_384);
        keyInfo.setParams(BrainpoolP320r1.DOMAIN_PARAMS);
        keyInfo.setKey(signatureService.getOrGenerateKey(subject));

        final CvCertificate.Body body = new CvCertificate.Body();
        body.setCar(dvca.getSubject());
        body.setPublicKey(keyInfo);
        body.setChr(subject);
        if (documentType == DocumentType.DL) // use EACv2 for DL only
            body.setAuthorization(authorization);

        final CvCertificate cv = new CvCertificate();
        body.setRaw(mapper.write(body));
        cv.setBody(body);

        final EcSignature inner = new EcSignature(signatureService.sign(cv, subject, true));
        cv.setSignature(inner);

        if (reference == null) {
            return mapper.write(cv);
        }

        CvCertificateRequest req = new CvCertificateRequest();
        cv.setRaw(mapper.write(cv));
        req.setCertificate(cv);
        req.setCar(reference);

        final EcSignature outer = new EcSignature(signatureService.sign(req, reference, true));
        req.setSignature(outer);

        return mapper.write(req);
    }
@Test
    public void shouldGenerateFirstATRequest() throws Exception {
        final HsmClient.KeyInfo keyInfo = new HsmClient.KeyInfo();
        keyInfo.setPublicKey(Hex.decode("04"
            + "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
            + "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
        ));
        Mockito.doReturn(keyInfo).when(hsmClient).generateKey(
            Mockito.eq("AT"), Mockito.eq("SSSSSSSSSSSSSSSS")
        );
        Mockito.doThrow(new nl.logius.digid.sharedlib.exception.ClientException("Not found",404)).when(hsmClient).keyInfo(
            Mockito.eq("AT"), Mockito.eq("SSSSSSSSSSSSSSSS")
        );

        final byte[] TBS = Base64.decode(
            "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS" +
                "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS");
        Mockito.doReturn(signature("SSSSSSSSSSSSSSSS")).when(hsmClient).sign(
            Mockito.eq("AT"), Mockito.eq("SSSSSSSSSSSSSSSS"),
            AdditionalMatchers.aryEq(TBS), Mockito.eq(true)
        );

        certificateRepo.save(loadCvCertificate("rdw/acc/cvca.cvcert", true));
        certificateRepo.save(loadCvCertificate("rdw/acc/dvca.cvcert", false));
        final byte[] der = service.generateAtRequest(DocumentType.DL, PolymorphType.PIP, "NL001", null);
        final CvCertificate at = mapper.read(der, CvCertificate.class);
        verifyAt(at, "SSSSSSSSSSSSSSSS", "SSSSSSSSSSSSSSSS", true);
    }