PKI revamp EST improvements and fixes

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -192,6 +192,26 @@ export const certificateV3ServiceFactory = ({
       ...certificateRequest,
       subjectAlternativeNames: certificateRequest.altNames
     });
+
+    let template;
+    try {
+      template = await certificateTemplateV2Service.getTemplateV2ById({
+        actor,
+        actorId,
+        actorAuthMethod,
+        actorOrgId,
+        templateId: profile.certificateTemplateId
+      });
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.`
+      });
+    }
+
+    if (!template) {
+      throw new NotFoundError({ message: "Certificate template not found for this profile" });
+    }
+
     const validationResult = await certificateTemplateV2Service.validateCertificateRequest(
       profile.certificateTemplateId,
       mappedCertificateRequest
@@ -214,18 +234,6 @@ export const certificateV3ServiceFactory = ({
       throw new BadRequestError({ message: "Authentication method is required for certificate issuance" });
     }
 
-    const template = await certificateTemplateV2Service.getTemplateV2ById({
-      actor,
-      actorId,
-      actorAuthMethod,
-      actorOrgId,
-      templateId: profile.certificateTemplateId
-    });
-
-    if (!template) {
-      throw new NotFoundError({ message: "Certificate template not found for this profile" });
-    }
-
     validateAlgorithmCompatibility(ca, template);
 
     const effectiveSignatureAlgorithm = certificateRequest.signatureAlgorithm as CertSignatureAlgorithm | undefined;