Well, why not just change the certificate for the whole server, as if you were using the primary domain.
I mean, overwrite the certificate, and when you access the domain from the virtual domain it will show up as correct, and from the primary domain as invalid (i.e. it will show it's a cert for the virtual domain).
G