Including .world lol

I checked just to be sure (and debugged some problems while I was at it like the certificate having been expired), the certificate is from Let's Encrypt via certbot.

Here is how to configure Cloudflare for this (I am using the free version):

In the settings under SSL/TLS Overview, in "Configure encryption mode", select "Custom SSL/TLS" instead of "Automatic SSL/TLS (default)", and under that select Full:

Full
Enable encryption end-to-end. Use this mode when your origin server supports SSL certification but does not use a valid, publicly trusted certificate.

Edit: looking into it more, might have been mistaken about how this works

It's a pain in the ass for sure. There are many things I can't see. It's worth it to not fund fascism.

I accedently turned on the orange cloud and mitm myself accedently. It was later some day when I checked my SSL cert that I found google certificate instead of let's encrypt that I realized the traffic is not terminating at my server.

So it looks like I'm only blocking subdomains for the challenges, ajax, and some other CDN stuff. I could try blocking the whole domain for a while and see what happens. It will probably result in the same access since I blocked challenges.

I have not had that one come up on my logs yet.

I am of the habit that I block it globally on the browser. Until perhaps a website that I have to use needs it.

Please actually compare the certificate when connecting to your server directly (bypassing Cloudflare) and connecting via Cloudflare. An easy way to do this is with openssl CLI:

openssl s_client -servername your-domain-here.org -connect your-ip-here:443 < /dev/null 2>/dev/null | openssl x509 -text -noout

Replace your-domain-here.org with your domain and your-ip-here with your actual server IP, but also do it with the Cloudflare IP.

The section about the "Full (strict)" / "Full" is referring to how Cloudflare verifies the certificate (or not in the case of Flexible and off) between your origin server and Cloudflare -- this is not with respect to the client and Cloudflare. The Custom origin certificates are also with respect to Cloudflare and your server (has no impact on certificate used between the client and Cloudflare). Cloudflare still uses a separate certificate that they have issued to themselves and hold the private key to use for the client.

If you pay extra for their "Advanced Certificate Manager", this allows you to upload a custom certificate to be used between the client and Cloudflare, but you have to provide the private key to Cloudflare because they still terminate SSL/TLS at their servers. Even their "Total TLS" service (part of ACM and the word "Total" could be mistaken to be "total" as in from client all the way to your origin server) does not provide E2EE.

I may be unaware of a newer service offering, but the only way that I'm aware of to get true E2EE is on their Enterprise plan (Keyless TLS). I have a lot of experience with Cloudflare for both personal and Enterprise plan (I was the technical person in charge of the account and configuring and such). Granted, I've not been dealing with CF enterprise for a few years now and they may have a new service offering outside of enterprise that I'm not familiar with, but my quick look around still looks like everything aside from Keyless TLS requires either giving them the key (in the case of ACM custom certificates) or they use their own certificate for client <-> Cloudflare. When I did manage the enterprise plan, we actually didn't use Keyless TLS because we used features that required them to terminate TLS anyway, so I can't speak to the specifics of it.

I hope I'm wrong though. I'd love to have true E2EE while still getting the DDoS protection on my personal stuff.

I agree - there definitely would need to be many more reverse proxy services, because the current dominance of just a handful is making the internet brittle in ways it wasn't before.

Yeah, I did ultimately realize this, maybe I should have written a bit more in my edit earlier but it's a bit embarrassing tbh, I had come to some wrong conclusions. I think what I'm going to do is simply stop using Cloudflare for anything that does not have an extra layer of encryption on top of https, or that isn't just a static, public webpage with no interactivity.

So, it was the subdomains for challenges, CDN, and what I think is something to do with JavaScript. I just moved it back because it's aggravating to block them.