Could you clarify the following points:
1. there is a domain alias, but there is no DNS records for it, am I correct?
2. if you know that the alias will be removed soon, why don't you just remove it from pre-selected list at first certificate issuing? :)
btw, "Keep secured" feature should try...