public Certificate add(X509Certificate cert) {
        final Certificate db;
        try {
            db = Certificate.from(cert);
        } catch (CertificateEncodingException e) {
            logger.error("Encoding error in certificate", e);
            throw new ClientException("Encoding error in certificate", e);
        }

        try {
            // Special case for first CSCA certificate for this document type
            if (repository.countByDocumentTypeAndType(db.getDocumentType(), db.getType()) == 0) {
                cert.verify(cert.getPublicKey());
                logger.warn("Added first CSCA certificate for {}, set trusted flag manually", db.getDocumentType());
            } else {
                verify(cert, allowAddingExpired ? cert.getNotAfter() : null);
            }
        } catch (GeneralSecurityException | VerificationException e) {
            logger.error(
                String.format("Could not verify certificate of %s issued by %s",
                    cert.getSubjectX500Principal(), cert.getIssuerX500Principal()
                ), e
            );
            throw new ClientException("Could not verify certificate", e);
        }
        return repository.saveAndFlush(db);
    }
@Test
    public void shouldAllowToAddCertificateIfFirstOfDocumentType() throws Exception {
        final Certificate rdw = loadCertificate("rdw/acc/csca.crt", true);
        final X509Certificate cert = readCertificate("nik/tv/csca.crt");
        final Certificate dbCert = service.add(cert);
        assertEquals(X509Factory.toCanonical(cert.getSubjectX500Principal()), dbCert.getSubject());
        assertEquals(false, dbCert.isTrusted());
    }