Cloudflare proxy (orange cloud) can hide the origin IP and add CDN features. For first-time SSL issuance, set the record to DNS-only (grey cloud) unless we agree an alternate validation method.

If you enable Full (Strict) SSL in Cloudflare, our origin certificate must be valid — which is the normal state once Let’s Encrypt has issued.