Today I received the good news from Optimizely support that they are now able to generate root domain certificates for us.