# Pem envelope validate

`pem-envelope-validate` · version 1.0.0 · Encoding & checksums · free, no key needed

Check one RFC 7468 PEM envelope for labels, whitespace, and strict base64.

**Use when you need to: validate pem envelope framing · check that pem begin and end labels match · is this pem message well formed.**

## Decide before calling

Read the [versioned contract](/v1/tools/pem-envelope-validate/versions/1.0.0) and the supported scope below. Reuse `pem-envelope-validate@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `pem-envelope-validate@1.0.0` for validate pem envelope framing. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- validate pem envelope framing
- check that pem begin and end labels match
- is this pem message well formed
- report why a pem block is rejected
- check rfc 7468 base64 and whitespace
- pem syntax check without trusting contents

## Not supported

- assert that the bytes are a real certificate or key
- repair a mismatched end label
- accept lax text that ignores non-base64 characters

## Behavior

- Well-typed text that fails Figure 1 returns {valid:false, reason}. Wrong types, unknown fields, lone surrogates, and declared limits throw. This is the opposite of pem-envelope-parse, which throws on the same syntax errors and returns the hex.
- On success the result is the label, the decoded byte count, whether the text is the Figure 3 canonical rendering, and the newline class (lf, crlf, cr, or mixed). The hex payload is not returned.
- Labels must match exactly, including case. "X509 CERTIFICATE" stays that label; it is not rewritten or accepted as "CERTIFICATE". Registered names in RFC 7468 section 4 are not required.
- Whitespace is Figure 1: SP and HTAB are ignored throughout the encoded text, including between base64 characters; CR, LF, and CRLF delimit lines. VT, FF, and explanatory prose before BEGIN are reasons, not repaired input.
- Strict base64 requires alphabet A-Za-z0-9+/, padding that completes a multiple of 4, and zero unused bits. A label above 64 bytes is limit_exceeded, checked before the body is decoded, so a too-long label is never copied into a successful result.
- Text above 8192 UTF-8 bytes is limit_exceeded before the scan. A grammar failure inside that bound is valid:false, not an exception.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `text` (string, required): min length 0; max length 8192

## Output

- `valid` (boolean, required)
- `label` (string, optional): min length 0; max length 64; pattern `^(?:[\x21-\x2C\x2E-\x7E](?:[ \x2D]?[\x21-\x2C\x2E-\x7E])*)?$`
- `byte_length` (integer, optional): min 0; max 8192
- `canonical` (boolean, optional)
- `eol` (one of "lf", "crlf", "cr", "mixed", optional)
- `reason` (one of "missing_begin", "extraneous_text", "bad_begin_line", "label_grammar", "bad_end_line", "label_mismatch", "missing_end", "blank_in_base64", "bad_whitespace", "bad_base64", "bad_padding", "non_canonical_base64", "non_ascii", optional)

## Limits

- max text bytes: 8192
- max label bytes: 64
- max output bytes: 512

## Example

Request input:

```json
{
  "text": "-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "label": "EXAMPLE",
    "byte_length": 1,
    "canonical": true,
    "eol": "lf"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "pem-envelope-validate",
  "version": "1.0.0",
  "input": {
    "text": "-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/pem-envelope-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"text":"-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"}'
```

The machine-readable contract is at [/v1/tools/pem-envelope-validate/versions/1.0.0](/v1/tools/pem-envelope-validate/versions/1.0.0).

### CLI

```sh
node cli.mjs run pem-envelope-validate 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Pem label validate](/tools/pem-label-validate): Check a PEM label against the RFC 7468 label grammar, without reading a payload.
- [Pem envelope format](/tools/pem-envelope-format): Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.
- [Pem envelope parse](/tools/pem-envelope-parse): Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.
- [Bech32 validate](/tools/bech32-validate): Check Bech32 or Bech32m text and return a reason, without throwing when the checksum fails.
- [Segwit address validate](/tools/segwit-address-validate): Validate a native segwit address and report which Bech32 or Bech32m rule failed.
- [Ct inclusion proof verify](/tools/ct-inclusion-proof-verify): Strictly verify an RFC 6962 v1 Merkle audit path.