The custom domains functionality can use one of two approaches for certificate management (https://auth0.com/docs/custom-domains#certificate-management); one where the certificate is managed by Auth0 so your custom domain identity.example.com would have a certificate that would not be managed by you and the other where you could manage the certificate yourself (this second option is only available for enterprise subscriptions).
Have in mind that with the first option only the certificate for the custom domain would be managed by the service; your top-level domain would still use the certificates managed by you.