[lukewarm707]

in this case it's my design to use cloudflare.

but you can also see from curl or traceroute, that the endpoint you talked to was a cloudflare ip and your ssl ended there. after that you can't see inside cloudflare.