Currently there's only an option to keep all aliases secured. This causes endless failure notification from Plesk if one of the domains is routed through an external DNS server and can't be automatically secured.

There should be an option to select which aliases will be automatically secured upon expiry.