Hello there.
Could you check if the installation of origin CA if that is working correctly?
521 error is a sign of web server down where you’ve enabled origin CA in cloudflare but not installed in the webserver. so, connection is blocked!
You may check this out to configure it correctly:
If you are using Cloudflare for subdomains, those records need to be proxied. Would you try doing that?
Read this if it is useful for you: