I've researched this topic while setting up a site on RedHat OpenShift that gives HTTPS enabled subdomains to users (*.rhcloud.com addresses). It turned out the OpenShift crew was not aware of the problem, but fortunately they are now added to the Mozilla Public Suffix List (https://openshift.redhat.com/community/forums/openshift/rhcl...)