Thank you guys for free TLS/SSL, but if I have a website/blog hosted on free services offered by PaaS providers, like Heroku or RedHat's OpenShift, to which I'v

Thank you guys for free TLS/SSL, but if I have a website/blog hosted on free services offered by PaaS providers, like Heroku or RedHat's OpenShift, to which I've CNAME'd a custom .com domain which is the only domain I want public access on, and I don't want "Full SSL" (Non-strict) which makes MITM attacks between CF and the PaaS provider viable (although very unlikely). Can I pin the certificate from PaaS providers for .herokuapp.com or .rhcloud.com to enable "Full SSL" (Strict) on CF? Although the SSL support for custom domains is a paid feature for most PaaS providers, this won't be true now if this is possible.