Having issue with custom/vanity domain SSL

I am getting invalid SSL error from a Custom Hostname that I added to my account.

Invalid SSL certificate Error code 526

Full (strict) is turned on for my SASS domain.

I have configured certificates for my primary domain and wildcard SSL certificate with the traefik config below, it is working. However, for Custom Hostname domains, it is required to add Cloudflare CA Origin
Certificate. Now I am not sure if what I did below to add SSL via cloudflare api is too different. Is it generating from letsencrypt or cloudflare? If from cloudflare, how is it different from Cloudflare CA Origin
Certificate? If different, how should I add Cloudflare CA Origin Certificate? and should I keep the one generated from the config below.

I am dealing with this few days now trying to fix this and I have come this far. Any help if appreciated. Thank you.

traefik:
  options:
    publish:
      - "443:443"
    volume:
      - ./letsencrypt:/letsencrypt
  args:
    entryPoints.web.address: ":80"
    entryPoints.websecure.address: ":443"
    entryPoints.web.http.redirections.entryPoint.to: websecure
    entryPoints.web.http.redirections.entryPoint.scheme: https
    entryPoints.web.http.redirections.entrypoint.permanent: true
    entrypoints.websecure.http.tls: true
    entrypoints.websecure.http.tls.domains[0].main: "mydomain.cloud"
    entrypoints.websecure.http.tls.domains[0].sans: "*.mydomain.cloud"
    certificatesResolvers.letsencrypt.acme.email: "[email protected]"
    certificatesResolvers.letsencrypt.acme.storage: "/letsencrypt/acme.json"
    certificatesresolvers.letsencrypt.acme.dnschallenge.provider: cloudflare
  env:
    secret:
      - CLOUDFLARE_API_KEY
    clear:
      CLOUDFLARE_EMAIL: '[email protected]'

servers:
  web:
    hosts: 5.161.50.3
    labels:
      traefik.http.routers.wb.rule: Host(`*.mydomain.cloud`) || Host(`mydomain.cloud`)
      traefik.http.routers.wb.entrypoints: websecure
      traefik.http.routers.wb.tls.certresolver: letsencrypt

By the way, I am using subdomain with cname for Custom Hostname and it’s verified and green.