Alias entry under wide IP

it's usually not needed.

in short, the hostnames in ssl certificate only need to match to the hostname of the http layer request.
client's ssl layer will automatically uses that http layer hostname for tls sni request field.
also, http and ssl/tls layer doesnt care about dns cname things.

so if the hostname in http(s)://<hostname>/........... doesnt change, then you dont need to update the ssl cert.