The solution I have found to this problem is to point the root domain to the mail server, make the certificates and then point the root domain to the web server. The only problem is that I thought that all the mail server certificates would fail when they were automatically renewed, but your answers make me think that each certificate is individual and only the root domain certificate will fail, which we do not need.
Thank you all for the answers