I have my domain mydomain.com, rented from OVH. I use HAProxy on PfSense to redirect mydomain.com and *.mydomain.com, and PfSense manages the DNS challenge certificate.

I would like the root mydomain.com to redirect to aa.mydomain.com (TLS certificate will be served by a third-party website e.g. GitHub to host my CV), but keep the wildcard certificate for all other subdomains on my PfSense.

Currently, the certificates for *.mydomain.com and mydomain.com are on my PfSense. All I have managed to do is serve the certificate for www.mydomain.com on the 3rd-party website and add a DNS record for that subdomain.