[BUG] Key-pair generation should not be proposed if EE profile does not allow it (edit EE)

[benoiton]

With EJBCA CE v9.3.7, Wildfly 35, PostgreSQL 16, Java 21, on Rocky 9. Firefox 152.

Context

• Brand new CA
• New CA profile from ENDUSER
  • ECDSA P-256
  • only my new CA
• New EE profile
  • only my new CA profile
  • only my new CA
  • only P12 token

On the RA, with a superadmin

• Create an EE, generate its certificate
• Search the EE, and edit it
• Change the status to "New"
• Key store type can be chosen among
  • Keypair generated by the user
  • JKS
  • P12
  • BCKFS
  • PEM
• If I choose JKS, a message appears: "End entity cannot be saved because it does not fulfill the end entity profile."
• If I choose P12, it's OK.

=> The RA should not propose do change the key store type if the profile does not allow it.

[benoiton]

Probably linked to #1057

[primetomas]

Right, the RA should sense that the EE profile contains. I guess that if you do the same in the Admin UI, you can not select JKS if P12 is the only available keystore type in the EE profile. Is that correct?

[benoiton]

I do confirm only P12 is proposed on Admin UI if the EE profile doesn't allow anything but P12.