Add CERT_DAYS setting and resolve_cert_days()

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openvpncertupdate.py

@@ -75,6 +75,10 @@ SMTP_TLS      = "starttls"  # "starttls" | "ssl" | "" (plain)
 
 DAYS_PAST   = 30
 DAYS_AHEAD  = 14
+CERT_DAYS   = "default"  # lifetime of certs this tool issues, in days.
+                         # "default" or "" = leave it to EasyRSA (your vars'
+                         # EASYRSA_CERT_EXPIRE). A positive integer overrides
+                         # it — e.g. 90.
 
 # Names an external .conf file is allowed to override — keep in sync with the
 # SETTINGS block above. Deliberately excludes CONFIG_PATH itself.
@@ -85,7 +89,7 @@ _OVERRIDABLE_SETTINGS = frozenset({
     "CRYPTGEON_URL",
     "MAIL_FROM", "MAIL_SUBJECT", "EMAIL_TEMPLATE_PATH", "MAIL_BINARY",
     "SMTP_HOST", "SMTP_PORT", "SMTP_USER", "SMTP_PASSWORD", "SMTP_TLS",
-    "DAYS_PAST", "DAYS_AHEAD",
+    "DAYS_PAST", "DAYS_AHEAD", "CERT_DAYS",
 })
 
 
@@ -413,6 +417,37 @@ def resolve_ca_passphrase(
     return configured
 
 
+def resolve_cert_days(configured, name: str = "CERT_DAYS") -> str:
+    """Resolve a configured certificate lifetime into an EasyRSA --days value.
+
+      "default" / "" → ""  (omit --days; EasyRSA's EASYRSA_CERT_EXPIRE wins)
+      positive number → that many days, normalised ("090" → "90")
+
+    Rejects 0, negatives and non-numeric input. EasyRSA rejects those itself,
+    but failing here keeps the error next to the input the user actually typed
+    — in the TUI that means the form is still open, and on the CLI it means no
+    CA passphrase prompt and no subprocess round-trip first.
+
+    `name` names the source ("CERT_DAYS", "--days", "Days") for the message.
+    """
+    text = str(configured).strip()
+    if text in ("", "default"):
+        return ""
+    try:
+        days = int(text)
+    except ValueError:
+        raise ConfigError(
+            f'{name} must be a positive number of days, "default" or "" '
+            f'(inherit from EasyRSA); got {configured!r}'
+        )
+    if days <= 0:
+        raise ConfigError(
+            f"{name} must be a positive number of days "
+            f"(EasyRSA rejects 0); got {configured!r}"
+        )
+    return str(days)
+
+
 # ============================================================
 # === CONFIG ===
 # ============================================================