Convert PEM (list and extract blocks, or wrap DER)
convert_pemDecodes PEM text into its blocks with labels, sizes and hashes, extracting one as DER, PEM or hex; encodes DER bytes into a strict PEM block. Private keys are never extracted or produced.
Instructions
The RFC 7468 layer. mode:'decode' lists every block of a PEM text (index, label, DER size, offset, RFC 1421 headers under pemMode:'lax', SHA-256 of the DER) — label keeps one kind, extractIndex also delivers that block as an artefact (encoding 'der' by default, 'pem' or 'hex'; inline as an embedded resource, or as a sandbox file with outputMode:'file' + outputPath, never overwritten). mode:'encode' wraps DER bytes (derBase64 or a DER file path) into one strict PEM block under label (required) and delivers it as the artefact (64-character lines, LF). A private-key block (PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA/EC/DSA PRIVATE KEY) is listed by label and size but never extracted, and never produced: SECURITY_VIOLATION (use inspect_private_key) — DER that parses as a PKCS#8 key or a PKCS#12 file is refused under ANY label. Refuses: derBase64 in decode, pem in encode, an encoding other than 'pem' in encode, a file output without extractIndex (VALIDATION_ERROR); an index past the last block (NOT_FOUND); a label absent from the text (PKI_PEM_UNEXPECTED_LABEL); a malformed text (PKI_PEM_* — pemMode:'lax' tolerates whitespace, line length and headers; a missing base64 padding is refused in both modes). Token-frugal: verbosity:'summary' (count + labels), fields:[…].
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | 'decode' lists the blocks of a PEM text (and extracts one with extractIndex); 'encode' wraps DER bytes into one PEM block. | |
| input | Yes | The PEM text (decode: pem or a path to a PEM file) or the DER bytes (encode: derBase64 or a path to a DER file): exactly one of pem / derBase64 / path. | |
| label | No | decode: list only the blocks with this label. encode: the label of the block (required; e.g. 'CERTIFICATE'). Upper-case words and digits separated by single spaces; a private-key label is refused (SECURITY_VIOLATION). | |
| fields | No | Dot-paths to keep after verbosity (arrays map over elements); unmatched paths land in _meta.unmatchedFields. | |
| limits | No | Raise pkinative's 22 named security bounds for this call (trusted input only; absent keys keep the engine defaults). A value above an operator ceiling (PKINATIVE_MCP_MAX_INPUT_BYTES, PKINATIVE_MCP_MAX_KDF_ITERATIONS, PKINATIVE_MCP_MAX_PATHS_EXPLORED) is LIMIT_CEILING_EXCEEDED; describe_engine lists the defaults and the ceilings. | |
| strict | No | Escalate the first engine warning to a PKI_STRICT_DIAGNOSTIC error instead of listing it in diagnostics[]. | |
| pemMode | No | 'strict' (RFC 7468 exactly, default) or 'lax' (tolerates whitespace, line length and RFC 1421 headers). | strict |
| encoding | No | Artefact encoding. decode + extractIndex: 'der' (default, raw bytes), 'pem' (the block re-emitted strictly) or 'hex' (inline only, ≤ 64 KiB). encode: always 'pem' (anything else is VALIDATION_ERROR). | |
| verbosity | No | 'summary' keeps the scalar fields only (token-frugal). | full |
| outputMode | No | 'base64' (default) returns the artefact inline as an embedded resource (≤ 50 MiB). 'file' writes it inside PKINATIVE_MCP_OUTPUT_DIR (never overwrites; ≤ 1 GiB) and returns a resource_link. | base64 |
| outputPath | No | Relative path inside the sandbox (only when outputMode='file'); the extension must match the encoding (.der .crt .cer .csr .crl .p7s .bin … for der; .pem for pem). Key-bearing extensions (.key .p8 .p12 .pfx) are refused: nothing here writes a private key. | |
| extractIndex | No | decode: also deliver the block with this index (its position in the text, as listed) as an artefact in `encoding`. A private-key block cannot be extracted (SECURITY_VIOLATION). | |
| encodingRules | No | 'der' (strict X.690 DER, default) or 'ber' (indefinite / non-minimal lengths and constructed strings, as legacy CMS producers write). | der |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| count | No | decode: number of blocks listed. | |
| label | No | encode: the label written. | |
| blocks | No | decode: every block of the text (or those with `label`), in order. A private-key block is listed by label and size only. | |
| labels | No | decode: the label of every block listed. | |
| sha256 | No | encode: SHA-256 of the DER wrapped (lowercase hex). | |
| artefact | No | The artefact delivered alongside the report: its facts here, its bytes once as the embedded resource (or the resource_link in file mode). | |
| extracted | No | decode: the block delivered as the artefact. | |
| sizeBytes | No | encode: the DER size wrapped. | |
| diagnostics | No | Non-fatal concerns the engine raised (PKI_DIAG_*, de-duplicated, at most 200; explain_code explains one). | |
| diagnosticCount | No | ||
| diagnosticCounts | No | Occurrences per diagnostic code. | |
| diagnosticsTruncated | No | true when distinct diagnostics beyond the 200 listed were dropped. |