PIV: Prevent --protect when in a FIPS unapproved state

Yubico · Jul 10, 2024 · 40d9e25 · 40d9e25
1 parent 7f2f55b
commit 40d9e25
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/ykman/_cli/piv.py b/ykman/_cli/piv.py
@@ -505,6 +505,11 @@ def change_management_key(
  """
  session = ctx.obj["session"]
 
+ if ctx.obj["fips_unready"] and protect:
+ raise CliFail(
+ "YubiKey FIPS must be in FIPS approved mode prior to using --protect."
+ )
+
  if not algorithm:
  try:
  algorithm = session.get_management_key_metadata().key_type