If it is loading fine on Full and the content was never anywhere else hosted, then we can rule out a stuck Cloudflare account, as the proxies do connect to your origin.
In that case, it really is down to the certificate validation. You might even want to use a network sniffer, to check what’s really sent over the network.
As for the 522, I can’t reach the machine at all any more. Address changed?