Fix re-issue for CNs whose issued cert file is missing

Renewal failed with an empty error box for any CN listed in index.txt
without a corresponding pki/issued/<CN>.crt — the state you get when an
index.txt is carried over from an older EasyRSA install but the issued/
files are not.

Two defects:

1. EasyRSA writes its diagnostics to stdout, not stderr: print() is
   `printf '%s\n'`, and both die() and user_error() route through it.
   stderr only carries output from the tools EasyRSA shells out to, and
   even that is silenced under -S/--silent-ssl. _run_easyrsa built its
   message from stderr alone, so every EasyRSA failure reported blank.
   _easyrsa_diagnostics() now merges both streams (stderr first, so the
   specific openssl message is not what the dialog clips) and drops the
   version banner and blank padding.

2. EasyRSA reads the serial out of the .crt itself, so revoke-issued
   cannot revoke a CN whose cert file is gone — and there is nothing to
   add to the CRL either. has_issued_cert() now gates the revoke and CRL
   steps in both CliRunner._issue() and CursesApp._process_cert(); the
   workflow warns and goes straight to build-client-full. An explicit
   --revoke / TUI `r` still fails loudly rather than silently no-op.

The post-build failure message now keys off whether a revoke actually
happened, not off is_renewal, so it no longer claims "has been revoked"
when nothing was.

Adds tests/test_app_reissue.py: the TUI re-issue path had no coverage at
all, and it is the path this bug was reported from.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_cli.py

@@ -4,6 +4,9 @@ from unittest.mock import MagicMock, patch, call
 import pytest
 
 from openvpncertupdate import CliRunner, _build_parser, main
+# Bound before _patch_issue() rebinds the module attribute, so tests can put
+# the real filesystem check back and exercise the wiring end to end.
+from openvpncertupdate import has_issued_cert as real_has_issued_cert
 
 
 # ---------------------------------------------------------------------------
@@ -13,6 +16,9 @@ from openvpncertupdate import CliRunner, _build_parser, main
 def _patch_issue(monkeypatch, ovpn_path="/out/cn_2026-01-01/client.ovpn",
                  one_time_url="https://cg.example.com/#/note/abc/xyz"):
     """Patch all side-effectful callables used by CliRunner._issue."""
+    # Default to "the issued .crt is there", the normal case; the tests that
+    # care about a missing cert file override this.
+    monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=True))
     monkeypatch.setattr("openvpncertupdate.revoke_issued", MagicMock())
     monkeypatch.setattr("openvpncertupdate.gen_crl", MagicMock())
     monkeypatch.setattr("openvpncertupdate.copy_crl", MagicMock())
@@ -108,6 +114,70 @@ def test_create_does_not_touch_crl(monkeypatch, capsys):
     mocks["copy_crl"].assert_not_called()
 
 
+def test_reissue_skips_revoke_when_cert_file_missing(monkeypatch, capsys):
+    # An index.txt copied from an older EasyRSA install lists V-status certs
+    # whose .crt was never carried over. EasyRSA reads the serial out of the
+    # .crt, so revoke-issued can only fail — issue the replacement instead.
+    mocks = _patch_issue(monkeypatch)
+    monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
+    CliRunner().reissue("y.kuts", "y.kuts@example.com")
+    mocks["revoke_issued"].assert_not_called()
+    mocks["gen_crl"].assert_not_called()
+    mocks["copy_crl"].assert_not_called()
+    mocks["build_client_full"].assert_called_once()
+    assert mocks["build_client_full"].call_args.args[2] == "y.kuts"
+
+
+def test_reissue_warns_when_revoke_skipped(monkeypatch, capsys):
+    mocks = _patch_issue(monkeypatch)
+    monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
+    CliRunner().reissue("y.kuts", "y.kuts@example.com")
+    err = capsys.readouterr().err
+    assert "nothing to revoke for y.kuts" in err
+    assert "issued/y.kuts.crt" in err
+
+
+def test_reissue_skipped_revoke_build_failure_does_not_claim_revocation(monkeypatch, capsys):
+    # Nothing was revoked, so the "has been revoked but no new cert" warning
+    # would be a lie here.
+    import openvpncertupdate
+    _patch_issue(monkeypatch)
+    monkeypatch.setattr("openvpncertupdate.has_issued_cert", MagicMock(return_value=False))
+    monkeypatch.setattr("openvpncertupdate.build_client_full",
+                        MagicMock(side_effect=openvpncertupdate.EasyRSAError("boom")))
+    with pytest.raises(SystemExit):
+        CliRunner().reissue("y.kuts", "y.kuts@example.com")
+    assert "has been revoked" not in capsys.readouterr().err
+
+
+def _reissue_against_real_pki(monkeypatch, tmp_path, cert_files):
+    """Run --reissue with the real has_issued_cert against a temp PKI layout."""
+    issued = tmp_path / "issued"
+    issued.mkdir()
+    for name in cert_files:
+        (issued / name).write_text("-----BEGIN CERTIFICATE-----\n")
+    mocks = _patch_issue(monkeypatch)
+    monkeypatch.setattr("openvpncertupdate.has_issued_cert", real_has_issued_cert)
+    monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", str(tmp_path))
+    CliRunner().reissue("y.kuts", "y.kuts@example.com")
+    return mocks
+
+
+def test_reissue_reads_pki_dir_and_skips_revoke_for_missing_crt(monkeypatch, capsys, tmp_path):
+    # issued/ exists but holds other people's certs — exactly the server state.
+    mocks = _reissue_against_real_pki(
+        monkeypatch, tmp_path, ["ivan.radchenko.crt", "s.krasota.crt"])
+    mocks["revoke_issued"].assert_not_called()
+    mocks["build_client_full"].assert_called_once()
+
+
+def test_reissue_reads_pki_dir_and_revokes_when_crt_present(monkeypatch, capsys, tmp_path):
+    mocks = _reissue_against_real_pki(monkeypatch, tmp_path, ["y.kuts.crt"])
+    mocks["revoke_issued"].assert_called_once()
+    mocks["gen_crl"].assert_called_once()
+    mocks["build_client_full"].assert_called_once()
+
+
 def test_reissue_continues_building_when_crl_regen_fails(monkeypatch, capsys):
     import openvpncertupdate
     mocks = _patch_issue(monkeypatch)