Closes#45291
**Related issue:** none
## Problem
Apple MacOS devices fail SCEP enrollment with a 400. The proxy sees the
request arrive with `+` signs in the base64 payload:
```
request_uri: /mdm/apple/scep?operation=PKIOperation&message=MIA...MokYg+nl4TGkZi...k0+BJ/...
```
Fleet logs show those `+` signs are interpreted as spaces, and the
decode fails:
```
component=http-mdm-apple-scep method=GET status=400
err="failed to base64 decode message: illegal base64 data at input byte 375:
...MokYg nl4TGkZi...k0 BJ/..."
```
## Root cause
`message()` in `server/mdm/scep/server/transport.go` reads the query
parameter via `r.URL.Query()`, which internally calls
`url.QueryUnescape` and converts every `+` to a space.
The bug is present on `main` as of 2026-04-09.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed SCEP PKIOperation handler so base64 payloads with `+` characters
are decoded correctly (no longer treated as spaces).
* **Tests**
* Added regression tests ensuring GET PKIOperation works with literal
`+` and percent-encoded `+` in the query message.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43319?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Sharon <sharon@fleetdm.com>
