Removing secure subdomain from google index

[marketing_zoovy.com]

we've noticed over the last few months that Google is not honoring our main website's robots.txt file.  We have added rules to disallow secure pages such as:

Disallow: /login.cgis
Disallow: /logout.cgis
Disallow: /password.cgis
Disallow: /customer/*

We have noticed that google is crawling these secure pages and then duplicating our complete
ecommerce website across our secure subdomain in the google index (duplicate content)

https://secure.domain.com/etc.

Our webmaster recently implemented a specific robots.txt file for the secure subdomain 
disallow all however, these duplicated secure pages remain in the index.

User-agent: *
Disallow: /

My question is should i request Google to remove these secure urls through Google Webmaster
Tools?

If so, is there any potential risk to my main ecommerce website?  We have 8,700 pages currently indexed
into google and would not want to risk any ill effects to our website.

How would I submit this request in the URL Removal tools specifically?  would inputting 
https://secure.domain.com/ cover all of the urls?

We do not want any secure pages being indexed to the index and all secure pages are 
served on the secure.domain example.

Please private message me for specific details if you'd like to see an example.

Thank you,

[KeriMorgret]

I think you're saying you have

mainwebsitethatsellsstuff.com
securesubdomainof.mainwebsitethatsellsstuff.com

and that you want to keep the main domain, and remove the subdomain, and that it's not a case of http vs https with the URL otherwise being the same, right?

You can verify a subdomain in Google Webmaster Tools and remove the entire subdomain. I've had to do this for a dev subdomain that accidentally got indexed. I was able to keep the main domain, and remove the subdomain. The key is to verify that subdomain, and leave the main domain alone, provided I'm understanding your question correctly.

[oznappies]

Do you need 8700 pages served on https? Protocol should transition when a page is ok to serve unsecured. Generally you would only serve pages on https that contain confidential information and have general content on http. If you look at the site and ask how many of those pages can a no logged in user see? If they are not protected by authorization then they do not need https as the content is publically viewable.

[blu42media]

URL Removal would not be a good action in this case.  According to Google, when they remove the https version, they will also remove the http version along with it.

How long ago did you implement the robots.txt exclusion for the https pages?  It will take Google some time to pull this from their index.  To help you can add the following on your https pages which will keep the pages from continuing to be cached: