You’ll need to disable proxy, run certbot, then re enable proxy.

LE won’t sign a site already cf encrypted, or behind cf (even with cf SSL disabled.)

You could try a DNS challenge or other method.

letsencrypt.org/docs/challenge-types/