Just to be clear... customer.paas.com is not a concern, as a wildcard for *.pass.com handles that. The problem is coordinating the rollout of paas.customer.com certificates onto your webserver.
For those that don't know, paas = "platform as a service".