Typically on their free accounts they use your cert for communication between them and you, and use cert they issue for communication between them and everyone else.

User -> CF cert -> CF -> your cert -> your server.

That's why I suggested examining the cert on your external facing page.

Regardless, one way or the other, they need to be able to decrypt your data in order to apply their services (WAF, etc).

Unless, again, you're just using DNS (grey cloud).