This isn't easily possible. A DNS zone base name has to be an A address to a single IP. It can not be an alias... this means every time you get openshiftapps.com moves your site to another ip address the zone would need to be updated to that ip address. What is usually done instead is you have a stable ip address in the zone which might be a proxy/redirecter to the alias part.

dogtagpki.org A record points to 209.132.183.105, and it has a redirect to www.dogtagpki.org, which is also hosted on openshiftapps. Could be the same done for port389.org?

FYI, the certificate for https://dogtagpki.org is bad (it is for *.redhat.com), so I would suggest to do this better.

dogtagpki.org is using redirect.redhat.com, which (as @till points out) does only have a *.redhat.com certificate.
If you request configuration on redirect.redhat.com to forward to www.port389.org from Red Hat IT, we can set up DNS to point there for you.
That won't have https, for that you'll have to use another redirector that takes care of certs, but dogtag is using redirect.rh.c.

For whomever sets up DNS on our nameservers, make very sure to confirm redirect.redhat.com is setup correctly with the correct redirect before you switch DNS.
redirect.redhat.com only sends 301 Moved Permanently, which means that as soon as people start getting that, their browsers will cache the redirect forever.

As an indication to what @smooge said: I just checked again, and the edge IP addresses for the Openshift load balancers have changed since you opened the ticket:

$ host www.port389.org
www.port389.org is an alias for wiki-389ds.b9ad.pro-us-east-1.openshiftapps.com.
wiki-389ds.b9ad.pro-us-east-1.openshiftapps.com is an alias for pro-us-east-1-infra-211691592.us-east-1.elb.amazonaws.com.
pro-us-east-1-infra-211691592.us-east-1.elb.amazonaws.com has address 52.86.86.57
pro-us-east-1-infra-211691592.us-east-1.elb.amazonaws.com has address 54.156.19.27

So manually maintaining port389.org to follow openshift is pretty much impossible, and you should probably try to use a redirector.

I've confirmed that the redirect.rh.c entry for port389.org exists (apparently it has for years, just not used), and pointed port389.org at it. Closing this for now.