A 521 does not indicate a certificate issue but a general network issue. Make sure no firewall is blocking Cloudflare requests and the addresses from IP Ranges are whitelisted.
And yes, Origin certificates do not have the hostname in the CN but only in the SANs. That’s not an issue, though. That warning you can ignore.