Ssh bastion host question

Hello,
I’ve created a bastion host in my config.yml according to this guide:
https://developers.cloudflare.com/cloudflare-one/tutorials/ssh-cert-bastion/#deploy-short-lived-certificates

Basically:

And I’ve created the application in the CF portal.

But how do I access it?

If I type ssh -J [email protected] [email protected] I get:
ERR failed to connect to origin error=“websocket: bad handshake” originURL=https://bastion.mydomain.com
websocket: bad handshake
kex_exchange_identification: Connection closed by remote host

If I change service: bastion to service: ssh://:22 then I can jump…