diff --git a/backend/bdd/features/steps/pki_acme.py b/backend/bdd/features/steps/pki_acme.py
index ba4507b65..5aab5531e 100644
--- a/backend/bdd/features/steps/pki_acme.py
+++ b/backend/bdd/features/steps/pki_acme.py
@@ -167,6 +167,25 @@ def step_impl(context: Context, var_name: str):
     context.vars[var_name] = response
 
 
+@given("I create a certificate template with the following config as {var_name}")
+def step_impl(context: Context, var_name: str):
+    jwt_token = context.vars["AUTH_TOKEN"]
+    template_slug = faker.slug()
+    config = replace_vars(json.loads(context.text), context.vars)
+    response = context.http_client.post(
+        "/api/v2/certificate-templates",
+        headers=dict(authorization="Bearer {}".format(jwt_token)),
+        json={
+            "projectId": context.vars["PROJECT_ID"],
+            "name": template_slug,
+            "description": "",
+        }
+        | config,
+    )
+    response.raise_for_status()
+    context.vars[var_name] = response
+
+
 @given('I have an ACME cert profile with external ACME CA as "{profile_var}"')
 def step_impl(context: Context, profile_var: str):
     profile_id = context.vars.get("PROFILE_ID")
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 93339eea9..76277c0bd 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -729,6 +729,8 @@ export const pkiAcmeServiceFactory = ({
               return { certificateId: result.certificateId };
             } else {
               const { certificateAuthority } = (await certificateProfileDAL.findByIdWithConfigs(profileId, tx))!;
+              // TODO: for internal CA, we rely on the internal certificate authority service to check CSR against the template
+              //       we should check the CSR against the template here
               // TODO: this is pretty slow, and we are holding the transaction open for a long time,
               //       we should queue the certificate issuance to a background job instead
               const cert = await orderCertificate(