Scenario:
You have a subdomain on CF, using DNS only, with SSL termination at the origin. You’ve enabled Total TLS which will automatically generate an edge certificate for any hostname proxied via CF. You switch your subdomain from DNS only to Proxied.
Issue:
Your subdomain is immediately proxied through CF and throws an SSL error until your edge certificate is verified and issued (generally a minute or two).
Suggestion:
Delay proxying via CF until the domain’s SSL cert is issued and valid.