From 774595f32ec9be82331668daa66c1ebcba50692e Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Date: Thu, 22 Jan 2026 13:34:53 -0600
Subject: [PATCH] Porting fix from micromdm/scep (#38638)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #38579

Porting this fix from upstream:
https://github.com/micromdm/scep/commit/a8623d6b71c383ed448ededb834401a014961e61

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
  - QA'd the change manually using micromdm/scep
---
 changes/38579-micromdm-scep-fix          |  1 +
 server/mdm/scep/server/transport.go      |  4 +++-
 server/mdm/scep/server/transport_test.go | 19 +++++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 changes/38579-micromdm-scep-fix

diff --git a/changes/38579-micromdm-scep-fix b/changes/38579-micromdm-scep-fix
new file mode 100644
index 0000000000..6948216595
--- /dev/null
+++ b/changes/38579-micromdm-scep-fix
@@ -0,0 +1 @@
+Fixed SCEP proxy to use standard base64 encoding for PKIOperation GET requests, ensuring compatibility with standard SCEP servers.
diff --git a/server/mdm/scep/server/transport.go b/server/mdm/scep/server/transport.go
index 004722bab5..0ef59db6bc 100644
--- a/server/mdm/scep/server/transport.go
+++ b/server/mdm/scep/server/transport.go
@@ -87,7 +87,9 @@ func EncodeSCEPRequest(ctx context.Context, r *http.Request, request interface{}
 		if len(req.Message) > 0 {
 			var msg string
 			if req.Operation == "PKIOperation" {
-				msg = base64.URLEncoding.EncodeToString(req.Message)
+				// Use standard base64 encoding (with + and /) as expected by SCEP servers.
+				// The subsequent params.Encode() call will URL-encode the + and / characters.
+				msg = base64.StdEncoding.EncodeToString(req.Message)
 			} else {
 				msg = string(req.Message)
 			}
diff --git a/server/mdm/scep/server/transport_test.go b/server/mdm/scep/server/transport_test.go
index becc5091d0..2e6731872b 100644
--- a/server/mdm/scep/server/transport_test.go
+++ b/server/mdm/scep/server/transport_test.go
@@ -86,6 +86,25 @@ func TestGetCACertMessage(t *testing.T) {
 	}
 }
 
+func TestEncodeSCEPRequest_PKIOperation_UsesStdBase64(t *testing.T) {
+	// Data that encodes to "++++////" in standard base64
+	testData := []byte{0xfb, 0xef, 0xbe, 0xff, 0xff, 0xff}
+
+	req, _ := http.NewRequest("GET", "http://example.com/scep", nil)
+	if err := scepserver.EncodeSCEPRequest(t.Context(), req, scepserver.SCEPRequest{
+		Operation: "PKIOperation",
+		Message:   testData,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify message decodes correctly with StdEncoding (not URLEncoding)
+	msg := req.URL.Query().Get("message")
+	if _, err := base64.StdEncoding.DecodeString(msg); err != nil {
+		t.Fatalf("message should be valid standard base64: %v", err)
+	}
+}
+
 func TestPKIOperation(t *testing.T) {
 	server, _, teardown := newServer(t)
 	defer teardown()