Filter Add certificate CA dropdown to custom SCEP only (#49020)

changes/48951-certificate-ca-dropdown-scep-only

@@ -0,0 +1 @@
+- Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.

frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tests.tsx

@@ -86,6 +86,32 @@ describe("AddCertModal", () => {
     mockServer.resetHandlers();
   });
 
+  it("lists only custom SCEP CAs in the CA dropdown", async () => {
+    // Return a mix of CA types; only the custom SCEP CA should be selectable.
+    mockServer.use(
+      http.get(baseUrl("/certificate_authorities"), () => {
+        return HttpResponse.json({
+          certificate_authorities: [
+            { id: 1, name: "TEST_SCEP_CA", type: "custom_scep_proxy" },
+            { id: 2, name: "TEST_DIGICERT_CA", type: "digicert" },
+            { id: 3, name: "TEST_NDES_CA", type: "ndes_scep_proxy" },
+            { id: 4, name: "TEST_HYDRANT_CA", type: "hydrant" },
+          ],
+        });
+      })
+    );
+
+    const { user } = await renderModal();
+
+    await user.click(screen.getByText("Select certificate authority"));
+    await waitFor(() => {
+      expect(screen.getByText("TEST_SCEP_CA")).toBeInTheDocument();
+    });
+    expect(screen.queryByText("TEST_DIGICERT_CA")).not.toBeInTheDocument();
+    expect(screen.queryByText("TEST_NDES_CA")).not.toBeInTheDocument();
+    expect(screen.queryByText("TEST_HYDRANT_CA")).not.toBeInTheDocument();
+  });
+
   it("renders the SAN field alongside the existing fields", async () => {
     await renderModal();
     expect(

frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx

@@ -87,10 +87,13 @@ const AddCertModal = ({
   );
   const caPartials = cAResp ?? [];
 
-  const caDropdownOptions = caPartials.map((cAP) => ({
-    value: cAP.id.toString(),
-    label: cAP.name,
-  }));
+  // Only custom SCEP CAs are supported for Android certificate profiles.
+  const caDropdownOptions = caPartials
+    .filter((cAP) => cAP.type === "custom_scep_proxy")
+    .map((cAP) => ({
+      value: cAP.id.toString(),
+      label: cAP.name,
+    }));
 
   const onInputChange = (update: { name: string; value: string }) => {
     const updatedFormData = { ...formData, [update.name]: update.value };