Like Cloudflare, it defeats the purpose of SSL. If you don't have control of the key then you should never use it as an encryption guarantee for your users.
Is it better than plain HTTP? Perhaps, but you should be aware of the pitfalls.
Can you use this certificate on your own server, running on for example Apache? Or do you have to use AWS cloudfront?
Oh yes please. More free SSL is very very good.
if you buy a cert for the main domain it will also work for www. automatically.