diff --git a/provisioner/rkp_factory_extraction_lib.cpp b/provisioner/rkp_factory_extraction_lib.cpp
index b7e1e34..ec70d08 100644
--- a/provisioner/rkp_factory_extraction_lib.cpp
+++ b/provisioner/rkp_factory_extraction_lib.cpp
@@ -267,3 +267,17 @@
         return getCsrV3(componentName, irpc, selfTest);
     }
 }
+
+bool isRemoteProvisioningSupported(IRemotelyProvisionedComponent* irpc) {
+    RpcHardwareInfo hwInfo;
+    auto status = irpc->getHardwareInfo(&hwInfo);
+    if (status.isOk()) {
+        return true;
+    }
+    if (status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
+        return false;
+    }
+    std::cerr << "Unexpected error when getting hardware info. Description: "
+              << status.getDescription() << "." << std::endl;
+    exit(-1);
+}
diff --git a/provisioner/rkp_factory_extraction_lib.h b/provisioner/rkp_factory_extraction_lib.h
index ae8ea6b..93c498a 100644
--- a/provisioner/rkp_factory_extraction_lib.h
+++ b/provisioner/rkp_factory_extraction_lib.h
@@ -53,3 +53,7 @@
 void selfTestGetCsr(
     std::string_view componentName,
     aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent* irpc);
+
+// Returns true if the given IRemotelyProvisionedComponent supports remote provisioning.
+bool isRemoteProvisioningSupported(
+    aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent* irpc);
diff --git a/provisioner/rkp_factory_extraction_tool.cpp b/provisioner/rkp_factory_extraction_tool.cpp
index 62d62cf..1cb1144 100644
--- a/provisioner/rkp_factory_extraction_tool.cpp
+++ b/provisioner/rkp_factory_extraction_tool.cpp
@@ -78,6 +78,11 @@
 }
 
 void getCsrForIRpc(const char* descriptor, const char* name, IRemotelyProvisionedComponent* irpc) {
+    // AVF RKP HAL is not always supported, so we need to check if it is supported before
+    // generating the CSR.
+    if (std::string(name) == "avf" && !isRemoteProvisioningSupported(irpc)) {
+        return;
+    }
     auto [request, errMsg] = getCsr(name, irpc, FLAGS_self_test);
     auto fullName = getFullServiceName(descriptor, name);
     if (!request) {