Maybe you can use letsencrypt's DNS-01 challenge. That works without an HTTP connection. But ultimately, I don't think you need a certificate on the server anyways, doesn't Cloudflare tunnel the traffic unencrypted?