diff --git a/zkey/keystore.c b/zkey/keystore.c
index 23bbf388..a5cb18fc 100644
--- a/zkey/keystore.c
+++ b/zkey/keystore.c
@@ -1685,6 +1685,14 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 	if (rc != 0)
 		goto out_free_key_filenames;
 
+	rc = cross_check_apqns(apqns, 0, true, keystore->verbose);
+	if (rc == -EINVAL)
+		goto out_free_key_filenames;
+	if (rc != 0 && rc != -ENOTSUP && noapqncheck == 0) {
+		warnx("Your master key setup is improper");
+		goto out_free_key_filenames;
+	}
+
 	rc = _keystore_get_card_domain(apqns, &card, &domain);
 	if (rc != 0)
 		goto out_free_key_filenames;
diff --git a/zkey/zkey.c b/zkey/zkey.c
index f4cfdb34..e766bc42 100644
--- a/zkey/zkey.c
+++ b/zkey/zkey.c
@@ -31,6 +31,7 @@
 #include "keystore.h"
 #include "misc.h"
 #include "pkey.h"
+#include "utils.h"
 
 /*
  * Program configuration
@@ -1060,6 +1061,8 @@ static int command_generate_repository(void)
  */
 static int command_generate(void)
 {
+	int rc;
+
 	if (g.pos_arg != NULL && g.name != NULL) {
 		warnx(" Option '--name|-N' is not valid for generating a key "
 		      "outside of the repository");
@@ -1100,6 +1103,14 @@ static int command_generate(void)
 			return EXIT_FAILURE;
 		}
 
+		rc = cross_check_apqns(NULL, 0, true, g.verbose);
+		if (rc == -EINVAL)
+			return EXIT_FAILURE;
+		if (rc != 0 && rc != -ENOTSUP) {
+			warnx("Your master key setup is improper");
+			return EXIT_FAILURE;
+		}
+
 		return g.clearkeyfile ? command_generate_clear()
 				      : command_generate_random();
 	}