Write a missing signing request and give up on a handshake that never returns.

A certificate already on disk still has to be renewable, and a reflector that never finishes TLS must not hold the session past the login timers.

Co-authored-by: Cursor <cursoragent@cursor.com>

station/protocol3_test.go

@@ -697,6 +697,11 @@ func TestTLSUsesTheCallsignCertificate(t *testing.T) {
 		t.Fatalf("presented %#v", peer)
 	}
 	v.refl.writeFrame(t, 12, nil)
+	typ, body := v.refl.readFrame(t)
+	if typ != 17 {
+		t.Fatalf("type %d, want the signing request written because none was stored", typ)
+	}
+	checkCSR(t, body, v.certDir)
 	v.serverAndKey(t, []string{"OPUS"})
 	v.beat(t)
 }
@@ -794,6 +799,53 @@ func TestHostMismatchRetriesOn3(t *testing.T) {
 	}
 }
 
+func TestMissingSigningRequestIsWritten(t *testing.T) {
+	v := startV3(t, "")
+	if err := os.Mkdir(v.certDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeKey(t, filepath.Join(v.certDir, "key.pem"), key)
+	if err := os.WriteFile(filepath.Join(v.certDir, "cert.pem"), signClient(t, v.pki, key, "DL1ABC"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	v.throughBundle(t)
+	v.tls(t, v.pki.serverConfig())
+	v.refl.writeFrame(t, 16, nil)
+	typ, body := v.refl.readFrame(t)
+	if typ != 17 {
+		t.Fatalf("type %d, want the signing request", typ)
+	}
+	checkCSR(t, body, v.certDir)
+}
+
+func TestHandshakeThatDoesNotFinishRetriesOn3(t *testing.T) {
+	v := startV3(t, "")
+	v.throughBundle(t)
+	gen := v.clock.Generation()
+	v.refl.writeFrame(t, 15, nil)
+	waitClock(t, v.clock, gen)
+	v.clock.Advance(15 * time.Second)
+	if _, err := v.st.Wait(context.Background(), func(s station.State) bool {
+		return s.Detail == "TLS handshake failed"
+	}); err != nil {
+		t.Fatal(err)
+	}
+	v.clock.BlockUntilWaiting(t)
+	v.clock.Advance(2 * time.Second)
+	v.refl.accept(t)
+	typ, body := v.refl.readFrame(t)
+	if typ != 5 || !versionIs(body, 3, 0) {
+		t.Fatalf("retry type %d body %v, want 3.0", typ, body)
+	}
+	if v.st.State().Detail != "TLS handshake failed" {
+		t.Fatalf("Detail = %q", v.st.State().Detail)
+	}
+}
+
 func TestTLSHandshakeFailureRetriesOn3(t *testing.T) {
 	v := startV3(t, "")
 	v.throughBundle(t)