The "Request CV certificate" page in the public web currently just throws NPE if there's an error, such as a CSR with the wrong issuer being used. This happens because 1) it does not check for errors from SignSessionBean, and 2) it tries to parse CV certificates as X509 certificates upon error.