The name on the certificate is not Cloudflare’s. It’s origin’s. There’s no legitimate mechanism for reverse proxies to operate HTTPs sites, other than to act as

The name on the certificate is not Cloudflare’s. It’s origin’s. There’s no legitimate mechanism for reverse proxies to operate HTTPs sites, other than to act as a dumb pipe. Calling it MITM is therefore entirely appropriate. Whether this protocol abuse is sanctioned by origin or not is entirely beside the point.