I suppose it's possible in theory but I'm not sure if Cloudflare would perform other checks. It's certainly the case with the Business and above accounts you c

I suppose it's possible in theory but I'm not sure if Cloudflare would perform other checks. It's certainly the case with the Business and above accounts you can upload custom certificates but I don't have one of those accounts to check if further validation is made regarding domain control. If they didn't it would seem on the face of it that both the conditions in the article* are met. * >Many users are hosted on the same IP address >Users have the ability to upload certificates for arbitrary names without proving domain control.