“use Cloudflare’s Origin CA,” which doesn’t work on here because vpanel only checks for Common Name, not Subject Alt Name for (i bet) weird reasons 
If a subjectAltName extension of type dNSName is present, that MUST
be used as the identity. Otherwise, the (most specific) Common Name
field in the Subject field of the certificate MUST be used. Although
the use of the Common Name is existing practice, it is deprecated and
Certification Authorities are encouraged to use the dNSName instead.