You’re not required to have an SSL cert behind cloudflare anyway, CF provides the cert the browser sees. You then put a self-signed cert on your origin and CF will accept it.