It shouldn't rely on server name, but on the actual key or signature. Actually, I believe many of hosts running behind the CloudFlare wouldn't want to expose an

It shouldn't rely on server name, but on the actual key or signature. Actually, I believe many of hosts running behind the CloudFlare wouldn't want to expose any meaningful server names, so the actual server location would be harder to spot. I.e. you generate your keypair and produce a self-signed certificate, you should be able to give your public key and the actual key would be used for authentication. The subject (and SANs) of the certificate are ignored so it could be like "/CN=localhost" - only the key material is what matters here. That would be secure - in a sense third-party attacker won't be able to sniff what's between you and CloudFlare. (Or you could generate your own (self-signed) CA, generate a certificate signed by this CA of yours, and give CloudFlare your CA's public key. This makes sense if you have multiple hosts and you don't want to share the same key.)