Would like a script to copy certs automatically from cPanel production server to dev server

[David263]

I manage several websites doing my development work under Windows, mirroring remote Linux production servers that run cPanel and WHM.

I am using the excellent but little-known scheme of creating a virtual domain called dev.example.com (or local.example.com) on the production server. There is no directory for this special subdomain, and no serving of requests. Instead, the Let's Encrypt private key and certificate pair (here called the certs) for the main domain and its subdomains are manually copied to the local Windows server and support HTTPS locally for the development websites. Since the dev.example.com subdomain is easily mapped to 127.0.0.1 using the HOSTS file, local HTTPS requests work using dev.example.com (with support for that subdomain in the server configuration) exactly the same as on the corresponding production server (assuming the same server TLS configuration).

The problem with such an approach to local web development is that the certs expire every few months and have to be copied, manually, at unknown times, from the production server to the development server.

I'd like to be able to download a script (in PHP and/or JavaScript) that would run on cPanel production servers and/or my development server that would do this copying automatically and securely whenever WHM performs the automatic Let's Encrypt certs renewals. The integration with cPanel should be easy, because cPanel has hooks that can run scripts on the production server. I don't have the time to research and create this script myself.

Then development work can use HTTPS just as universally and easily as production servers, relying on cPanel and Let's Encrypt for automatic renewals and on this new script for updating the development certs so everything keeps working.

This would be simpler than having a local OpenSSL CA that renews certs, and certain cross-origin tests would be able to be done locally instead of one the production server. Also, the dev browsers would not need to accept the local CA.