Without Cloudflare, or with Unproxied () / DNS-only records: Visitor ↔ Web server
With Proxied () records: Visitor ↔ Cloudflare ↔ Web server
So, by having Proxied () records, you also have two different connections to secure. Cloudflare will take care of the first (Visitor ↔ Cloudflare) with the Edge Certificate from Universal SSL, and the certificate on your own server will take care of the latter (Cloudflare ↔ Web server).
The error you quote, is because the SSL certificate on your own server, e.g. your hosting provider, isn’t a valid certificate.
If you’re hosting with Firestorm, then it will be the certificate on their servers that isn’t valid, and them you will need to talk to, in order to correct the issue.