[matt4077]

From what I remember, CF actually requires an ssl certificate, but they'll accept a self-signed one (because they already validate ownership themselves.

[homero]

That can be mitmed but they fixed it https://blog.cloudflare.com/cloudflare-ca-encryption-origin/