PIV: Make PUBLIC-KEY optional when generating certificate

ykman/_cli/piv.py

@@ -1120,7 +1120,9 @@ def export_certificate(ctx, format, slot, certificate):
 @click_management_key_option
 @click_pin_option
 @click_slot_argument
-@click.argument("public-key", type=click.File("rb"), metavar="PUBLIC-KEY")
+@click.argument(
+ "public-key", type=click.File("rb"), metavar="PUBLIC-KEY", required=False
+)
 @click.option(
  "-s",
  "--subject",
@@ -1164,8 +1166,13 @@ def generate_certificate(
  except NotSupportedError:
  timeout = 1.0
 
- data = public_key.read()
- public_key = serialization.load_pem_public_key(data, default_backend())
+ if public_key:
+ data = public_key.read()
+ public_key = serialization.load_pem_public_key(data, default_backend())
+ elif session.version < (5, 4, 0):
+ raise CliFail("PUBLIC-KEY required for YubiKey prior to 5.4.")
+ else:
+ public_key = session.get_slot_metadata(slot).public_key
 
  now = datetime.datetime.now(datetime.timezone.utc)
  valid_to = now + datetime.timedelta(days=valid_days)