diff --git a/src/swtpm_cert/ek-cert.c b/src/swtpm_cert/ek-cert.c
index cb0d016f..d7b7a8e0 100644
--- a/src/swtpm_cert/ek-cert.c
+++ b/src/swtpm_cert/ek-cert.c
@@ -1034,8 +1034,20 @@ static void capabilities_print_json(void)
             "}\n");
 }
 
-int
-main(int argc, char *argv[])
+static bool check_keychoice(const char **keychoice, const char *kc)
+{
+    if (*keychoice && strcmp(*keychoice, kc) != 0) {
+        fprintf(stderr,
+                "Already found options for '%s' key; cannot switch to '%s'.\n",
+                *keychoice, kc);
+        return false;
+    }
+    *keychoice = kc;
+    return true;
+}
+
+
+int main(int argc, char *argv[])
 {
     int ret = 1;
     EVP_PKEY *pubkey = NULL;
@@ -1092,6 +1104,7 @@ main(int argc, char *argv[])
     int flags = 0;
     bool is_ecc = false;
     char *endptr;
+    const char *keychoice = NULL;
     static struct option long_options[] = {
         {"pubkey", required_argument, NULL, 'p'},
         {"modulus", required_argument, NULL, 'm'},
@@ -1142,30 +1155,39 @@ main(int argc, char *argv[])
 #endif
         switch (opt) {
         case 'p': /* --pubkey */
+            if (!check_keychoice(&keychoice, "read from file"))
+                goto cleanup;
             pubkey_filename = optarg;
             break;
         case 'm': /* --modulus */
             free(modulus_bin);
-            if (!(modulus_bin = hex_str_to_bin(optarg, &modulus_len))) {
+            if (!(modulus_bin = hex_str_to_bin(optarg, &modulus_len)))
+                goto cleanup;
+            if (!check_keychoice(&keychoice, "RSA"))
                 goto cleanup;
-            }
             break;
         case 'x': /* --ecc-x */
             free(ecc_x_bin);
-            if (!(ecc_x_bin = hex_str_to_bin(optarg, &ecc_x_len))) {
+            if (!(ecc_x_bin = hex_str_to_bin(optarg, &ecc_x_len)))
+                goto cleanup;
+            if (!check_keychoice(&keychoice, "EC"))
                 goto cleanup;
-            }
             break;
         case 'y': /* --ecc-y */
             free(ecc_y_bin);
-            if (!(ecc_y_bin = hex_str_to_bin(optarg, &ecc_y_len))) {
+            if (!(ecc_y_bin = hex_str_to_bin(optarg, &ecc_y_len)))
+                goto cleanup;
+            if (!check_keychoice(&keychoice, "EC"))
                 goto cleanup;
-            }
             break;
         case 'z': /* --ecc-curveid */
+            if (!check_keychoice(&keychoice, "EC"))
+                goto cleanup;
             ecc_curveid = optarg;
             break;
         case 'e': /* --exponent */
+            if (!check_keychoice(&keychoice, "RSA"))
+                goto cleanup;
             errno = 0;
             exponent = strtol(optarg, &endptr, 0);
             if (errno || endptr == optarg || *endptr != '\0') {
@@ -1337,9 +1359,8 @@ main(int argc, char *argv[])
         goto cleanup;
     }
 
-    if (modulus_bin && (ecc_x_bin || ecc_y_bin)) {
-        fprintf(stderr, "RSA modulus and ECC parameters cannot both be "
-                "given.\n");
+    if (keychoice == NULL) {
+        fprintf(stderr, "No parameters for a public key were given.\n");
         goto cleanup;
     }