Test environments need certificates too.
WHY
If staging runs on http while production runs on https, you are not testing the same thing. Mixed content and redirect behaviour differ.
ON A SUBDOMAIN
Create staging.yourdomain.com in cPanel, then run AutoSSL covering it. The certificate is issued exactly as for any other subdomain.
KEEPING IT PRIVATE
Add cPanel Directory Privacy so the public cannot reach it, and set the application to discourage search engine indexing.
Note that issuing a certificate publishes the subdomain name in certificate transparency logs. Do not rely on an obscure name for privacy.
ON A LOCAL MACHINE
Local development uses self-signed certificates or a local certificate tool. Browsers warn, which is acceptable for local work.
WHEN PUSHING TO LIVE
Check the site address is updated to the production https URL, and run a search and replace for the staging URL in content.
A common error is a live site loading images from the staging subdomain, which breaks when staging is deleted.
