3c4bcee202
Closes #45291 **Related issue:** none ## Problem Apple MacOS devices fail SCEP enrollment with a 400. The proxy sees the request arrive with `+` signs in the base64 payload: ``` request_uri: /mdm/apple/scep?operation=PKIOperation&message=MIA...MokYg+nl4TGkZi...k0+BJ/... ``` Fleet logs show those `+` signs are interpreted as spaces, and the decode fails: ``` component=http-mdm-apple-scep method=GET status=400 err="failed to base64 decode message: illegal base64 data at input byte 375: ...MokYg nl4TGkZi...k0 BJ/..." ``` ## Root cause `message()` in `server/mdm/scep/server/transport.go` reads the query parameter via `r.URL.Query()`, which internally calls `url.QueryUnescape` and converts every `+` to a space. The bug is present on `main` as of 2026-04-09. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed SCEP PKIOperation handler so base64 payloads with `+` characters are decoded correctly (no longer treated as spaces). * **Tests** * Added regression tests ensuring GET PKIOperation works with literal `+` and percent-encoded `+` in the query message. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43319?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Sharon <sharon@fleetdm.com>
