diff --git a/src/pki/commands/acert.c b/src/pki/commands/acert.c
index 7f91bf9b1..9084ef601 100644
--- a/src/pki/commands/acert.c
+++ b/src/pki/commands/acert.c
@@ -64,11 +64,7 @@ static int acert()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c
index d8e908f01..c106237c8 100644
--- a/src/pki/commands/issue.c
+++ b/src/pki/commands/issue.c
@@ -185,11 +185,7 @@ static int issue()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/commands/req.c b/src/pki/commands/req.c
index d9effb1d6..2578805f5 100644
--- a/src/pki/commands/req.c
+++ b/src/pki/commands/req.c
@@ -105,12 +105,7 @@ static int req()
 				}
 				continue;
 			case 'R':       /* --rsa-padding */
-				if (streq(arg, "pss"))
-				{
-
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/commands/scep.c b/src/pki/commands/scep.c
index de36d0abd..3f58336f4 100644
--- a/src/pki/commands/scep.c
+++ b/src/pki/commands/scep.c
@@ -162,15 +162,7 @@ static int scep()
 				}
 				continue;
 			case 'R':       /* --rsa-padding */
-				if (streq(arg, "pss"))
-				{
-					pss = TRUE;
-				}
-				else if (streq(arg, "pkcs1"))
-				{
-					pss = FALSE;
-				}
-				else
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c
index c9c63465c..da75dc68c 100644
--- a/src/pki/commands/self.c
+++ b/src/pki/commands/self.c
@@ -129,11 +129,7 @@ static int self()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c
index 8df42220c..f854bdc87 100644
--- a/src/pki/commands/signcrl.c
+++ b/src/pki/commands/signcrl.c
@@ -146,11 +146,7 @@ static int sign_crl()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
+				if (!parse_rsa_padding(arg, &pss))
 				{
 					error = "invalid RSA padding";
 					goto usage;
diff --git a/src/pki/pki.c b/src/pki/pki.c
index b7ced926e..0b03bf7aa 100644
--- a/src/pki/pki.c
+++ b/src/pki/pki.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2018 Tobias Brunner
+ * Copyright (C) 2012-2023 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -238,6 +238,26 @@ void set_file_mode(FILE *stream, cred_encoding_type_t enc)
 #endif
 }
 
+/*
+ * Described in header
+ */
+bool parse_rsa_padding(char *padding, bool *pss)
+{
+	if (streq(padding, "pss"))
+	{
+		*pss = TRUE;
+	}
+	else if (streq(padding, "pkcs1"))
+	{
+		*pss = FALSE;
+	}
+	else
+	{
+		return FALSE;
+	}
+	return TRUE;
+}
+
 /**
  * Determine a default hash algorithm for the given key
  */
diff --git a/src/pki/pki.h b/src/pki/pki.h
index eee42c6a0..df98bd070 100644
--- a/src/pki/pki.h
+++ b/src/pki/pki.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017 Tobias Brunner
+ * Copyright (C) 2015-2023 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -58,6 +58,15 @@ bool calculate_lifetime(char *format, char *nbstr, char *nastr, time_t span,
  */
 void set_file_mode(FILE *stream, cred_encoding_type_t enc);
 
+/**
+ * Parse RSA padding configuration.
+ *
+ * @param padding	input string to parse
+ * @param pss		set to TRUE if PSS padding should be used, FALSE otherwise
+ * @return			TRUE if successfully parsed
+ */
+bool parse_rsa_padding(char *padding, bool *pss);
+
 /**
  * Determine the signature scheme and parameters for the given private key and
  * hash algorithm and whether to use PSS padding for RSA.