That's just how cloudflare works. It can't know what to cache, or use any rules based on the http request without decrypting the traffic. And without decrypting

That's just how cloudflare works. It can't know what to cache, or use any rules based on the http request without decrypting the traffic. And without decrypting the request it can't do any application layer DDoS prevention. When you use cloudflare, or any other CDN, you either give them a certificate for your domain, or use DNS to allow them to acquire a certificate on your behalf.