# Pem label validate

`pem-label-validate` · version 1.0.0 · Encoding & checksums · free, no key needed

Check a PEM label against the RFC 7468 label grammar, without reading a payload.

**Use when you need to: validate a pem label · check rfc 7468 label grammar · is this begin-end label well formed.**

## Decide before calling

Read the [versioned contract](/v1/tools/pem-label-validate/versions/1.0.0) and the supported scope below. Reuse `pem-label-validate@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `pem-label-validate@1.0.0` for validate a pem label. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- validate a pem label
- check rfc 7468 label grammar
- is this begin-end label well formed
- pem label character rules
- allow a space inside a pem label
- reject consecutive hyphens in a pem label

## Not supported

- decide whether the label matches the payload type
- case-fold a label to an uppercase registered name
- map a label onto an asn.1 module

## Behavior

- The label matches RFC 7468 section 3: empty, or one labelchar followed by groups of an optional single SP or hyphen and another labelchar. labelchar is printable US-ASCII except SP (0x20) and hyphen (0x2D). Case is significant and is not folded.
- The first failing position wins: a separator at either end is edge_separator, two separators in a row are consecutive_separator, and any other rejected character is bad_character. A grammar failure of a label within the byte bound returns {valid:false, reason} and does not throw.
- Registered labels in section 4 (CERTIFICATE, X509 CRL, ENCRYPTED PRIVATE KEY, and the rest) are ordinary strings under this grammar. "X.509 CERTIFICATE" is grammatical and is not equated with "CERTIFICATE".
- The byte limit of 64 is checked before the grammar. A label of 65 bytes is limit_exceeded, not a false result, including when the extra characters would also fail the grammar. RFC 7468 does not define this bound; the output schema uses the same 64.
- A lone surrogate throws invalid_input. Ordinary non-ASCII inside the byte bound is bad_character. This tool does not look at a PEM body and makes no certificate or key claim.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `label` (string, required): min length 0; max length 64

## Output

- `valid` (boolean, required)
- `length` (integer, optional): min 0; max 64
- `reason` (one of "bad_character", "consecutive_separator", "edge_separator", optional)

## Limits

- max label bytes: 64
- max output bytes: 160

## Example

Request input:

```json
{
  "label": "CERTIFICATE"
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "length": 11
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "pem-label-validate",
  "version": "1.0.0",
  "input": {
    "label": "CERTIFICATE"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/pem-label-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"label":"CERTIFICATE"}'
```

The machine-readable contract is at [/v1/tools/pem-label-validate/versions/1.0.0](/v1/tools/pem-label-validate/versions/1.0.0).

### CLI

```sh
node cli.mjs run pem-label-validate 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Pem envelope validate](/tools/pem-envelope-validate): Check one RFC 7468 PEM envelope for labels, whitespace, and strict base64.
- [Pem envelope format](/tools/pem-envelope-format): Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.
- [Pem envelope parse](/tools/pem-envelope-parse): Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.
- [Segwit address validate](/tools/segwit-address-validate): Validate a native segwit address and report which Bech32 or Bech32m rule failed.
- [Bech32 validate](/tools/bech32-validate): Check Bech32 or Bech32m text and return a reason, without throwing when the checksum fails.
- [Ct inclusion proof verify](/tools/ct-inclusion-proof-verify): Strictly verify an RFC 6962 v1 Merkle audit path.