Explains Off, Flexible, Full and Full (strict). Flexible encrypts only visitor-to-Cloudflare; Full (strict) also validates the origin certificate (public CA or Cloudflare Origin CA) and is the recommended choice.
Read the full article on developers.cloudflare.comSource: Encryption modes by Cloudflare. Licence: Link only (©).
Answers common questions: certificates are free DV only, last 90 days (renew about every 60), the private key stays on your server, wildcards require DNS-01, and requesting a cert can attract crawler traffic because of Certificate Transparency logs.
The reference for Certbot: certonly vs installer plugins, standalone/webroot/manual/DNS validation, renewal, hooks, revocation and deletion. Read the renew and hooks sections to automate reloading your web server.
Compares HTTP-01 (file on port 80), DNS-01 (TXT record at _acme-challenge) and TLS-ALPN-01. DNS-01 is the one needed for wildcards or servers that are not publicly reachable, but it needs a DNS API and narrowly scoped credentials.