Add --days CLI flag overriding CERT_DAYS

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openvpncertupdate.py

@@ -1530,7 +1530,7 @@ class CliRunner:
         print(f"Building certificate for {cn}…", file=sys.stderr)
         try:
             build_client_full(EASYRSA_DIR, EASYRSA_PKI_DIR, cn, password, CA_PASSPHRASE,
-                              email=email_addr)
+                              email=email_addr, days=CERT_DAYS)
         except EasyRSAError as exc:
             if revoked:
                 print(
@@ -1611,6 +1611,9 @@ def _build_parser() -> argparse.ArgumentParser:
     group.add_argument("--list-all", action="store_true", help="List all CNs with email")
     parser.add_argument("--email",  metavar="EMAIL",
                         help="Email address (required for --create; optional for --reissue)")
+    parser.add_argument("--days", metavar="N",
+                        help="Certificate lifetime in days for --create/--reissue "
+                             "(overrides CERT_DAYS; omit to use CERT_DAYS)")
     parser.add_argument("--send-email", dest="send_email", action="store_const", const=True,
                         default=None, help="Send email after issuing cert (default unless --show-eml)")
     parser.add_argument("--no-send-email", dest="send_email", action="store_const", const=False,
@@ -1640,6 +1643,14 @@ def main() -> None:
         sys.exit(1)
     globals().update(overrides)
 
+    global CERT_DAYS
+    try:
+        CERT_DAYS = (resolve_cert_days(args.days, "--days") if args.days is not None
+                     else resolve_cert_days(CERT_DAYS))
+    except ConfigError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        sys.exit(1)
+
     if args.list:
         CliRunner().list_certs(show_all=False)
         return