Use a DNS provider that allows you to securely redirect the root domain. It is recommended to contact the potential DNS provider directly prior to purchasing their services to ensure that they can provide this functionality.
Purchase a server, install an SSL certificate on that server, and configure that server to forward traffic from the secure root domain.
Redirecting the root domain to the subdomain over https isn't always necessary. If you hosted content under the secure root domain (https://mydomain.com) before migrating your website to HubSpot, your pages may still be indexed by Google under the root domain. To confirm if this is the case, you can entersite:[mydomain].cominto Google to only search for pages under that domain.