From 945a4d151869628abfedaa71c5efa7841184df86 Mon Sep 17 00:00:00 2001
From: Tim Lee <timlee@fleetdm.com>
Date: Fri, 10 Jul 2026 11:14:28 -0600
Subject: [PATCH] Filter Add certificate CA dropdown to custom SCEP only
 (#49020)

---
 .../48951-certificate-ca-dropdown-scep-only   |  1 +
 .../AddCertificateModal.tests.tsx             | 26 +++++++++++++++++++
 .../AddCertificateModal.tsx                   | 11 +++++---
 3 files changed, 34 insertions(+), 4 deletions(-)
 create mode 100644 changes/48951-certificate-ca-dropdown-scep-only

diff --git a/changes/48951-certificate-ca-dropdown-scep-only b/changes/48951-certificate-ca-dropdown-scep-only
new file mode 100644
index 0000000000..a2495cd0d0
--- /dev/null
+++ b/changes/48951-certificate-ca-dropdown-scep-only
@@ -0,0 +1 @@
+- Fixed the Add certificate modal (Controls > OS settings > Certificates) to only list custom SCEP CAs in the "Certificate authority (CA)" dropdown, matching the modal's help text.
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tests.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tests.tsx
index 82e4f2ca8e..ebbaa95fdc 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tests.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tests.tsx
@@ -86,6 +86,32 @@ describe("AddCertModal", () => {
     mockServer.resetHandlers();
   });
 
+  it("lists only custom SCEP CAs in the CA dropdown", async () => {
+    // Return a mix of CA types; only the custom SCEP CA should be selectable.
+    mockServer.use(
+      http.get(baseUrl("/certificate_authorities"), () => {
+        return HttpResponse.json({
+          certificate_authorities: [
+            { id: 1, name: "TEST_SCEP_CA", type: "custom_scep_proxy" },
+            { id: 2, name: "TEST_DIGICERT_CA", type: "digicert" },
+            { id: 3, name: "TEST_NDES_CA", type: "ndes_scep_proxy" },
+            { id: 4, name: "TEST_HYDRANT_CA", type: "hydrant" },
+          ],
+        });
+      })
+    );
+
+    const { user } = await renderModal();
+
+    await user.click(screen.getByText("Select certificate authority"));
+    await waitFor(() => {
+      expect(screen.getByText("TEST_SCEP_CA")).toBeInTheDocument();
+    });
+    expect(screen.queryByText("TEST_DIGICERT_CA")).not.toBeInTheDocument();
+    expect(screen.queryByText("TEST_NDES_CA")).not.toBeInTheDocument();
+    expect(screen.queryByText("TEST_HYDRANT_CA")).not.toBeInTheDocument();
+  });
+
   it("renders the SAN field alongside the existing fields", async () => {
     await renderModal();
     expect(
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx
index bb443334e4..a4d9e28b87 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx
@@ -87,10 +87,13 @@ const AddCertModal = ({
   );
   const caPartials = cAResp ?? [];
 
-  const caDropdownOptions = caPartials.map((cAP) => ({
-    value: cAP.id.toString(),
-    label: cAP.name,
-  }));
+  // Only custom SCEP CAs are supported for Android certificate profiles.
+  const caDropdownOptions = caPartials
+    .filter((cAP) => cAP.type === "custom_scep_proxy")
+    .map((cAP) => ({
+      value: cAP.id.toString(),
+      label: cAP.name,
+    }));
 
   const onInputChange = (update: { name: string; value: string }) => {
     const updatedFormData = { ...formData, [update.name]: update.value };