My understanding is that even if you run behind Cloudfare, you need to secure your connection to Cloudfare with a certificate?
I wouldn't run my Web apps without something like Cloudflare in front; it's great for DDoS, WAF, Rate Limiting, so on.
Assuming that, I just use the Cloudflare-signed certificate and configure that in my Nginx. It's really easy to do and it expires in 20 years or something.