Using HTTP-01 challenge with servers on different subdomains

[tmi]

I have a server on a root domain pointed to with an A record.

The website is hosted on a different server, a hosting provider at the www. subdomain.

A global 301 redirect points any web traffic looking up the root domain to the www. subdomain.

The www. subdomain is secured with Let's Encrypt.

We need a cert for the root domain, but the .well-known folder gets redirected to the www. subdomain.

Can I use a selective rewrite to allow the Welcome rootdomain.org - BlueHost.com to be served by the root server, redirecting everything else as before, allowing it to obtain it's own valid cert, without interfering with the prod on www.?

The documentation for HTTPS-01 Acme challenge is not clear -- it says to support multiple servers, the challenge file must be on each server, but it's not clear if that applies to multiple servers on the same subdomain or multiple servers across different subdomains.

I can login to a root shell on my machine (yes or no, or I don't know):

No

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

Plesk

[Osiris]

@tmi

Can I use a selective rewrite to allow the Welcome rootdomain.org - BlueHost.com to be served by the root server, redirecting everything else as before, allowing it to obtain it's own valid cert, without interfering with the prod on www.?

Sure. Just redirect to the www subdomain for everything except the path /.well-known/acme-challenge/.

@tmi

The documentation for HTTPS-01 Acme challenge is not clear -- it says to support multiple servers, the challenge file must be on each server, but it's not clear if that applies to multiple servers on the same subdomain or multiple servers across different subdomains.

That's a different scenario. In the part you're mentioning it's multiple servers behind a single hostname. You have a single server per hostname for multiple hostnames.