Hi @donchev,
Just guessing... I suppose you issued your certificates using tls-sni-01 challenge, this challenge is now deprecated and will only works if you are trying to renew an existing certificate issued using this challenge, also, due the way this challenge works it isn't possible to use it with cloudflare activated due cloudflare is terminating the TLS connection instead of your origin web server.
As I said, I'm just guessing and you should provide the command used to issue your certificates but right now you have two options to renew your certs without pausing cloudflare and it is using http-01 or dns-01 challenges (in this case I think http-01 will be the easiest challenge to accomplish the task.
You should re-issue.your certs but this time using the http-01 challenge but this action will depends on the certbot version used, if using 0.21.1 or above this command could solve your issue:
Warning: Backup /etc/letsencrypt/ completely before issuing any of the below commands... just in case 
certbot renew --preferred-challenges http-01
if you are not using that version or above you could re-issue your certs using webroot method:
First issue this command:
certbot certificates
and you will get a list of your certificates, for example:
Certificate Name: my.domain.tld
Domains: my.domain.tld
Expiry Date: 2018-05-28 04:17:25+00:00 (VALID: 65 days)
Certificate Path: /etc/letsencrypt/live/my.domain.tld/fullchain.pem
Private Key Path: /etc/letsencrypt/live/my.domain.tld/privkey.pem
Certificate Name: otherdomain.tld
Domains: otherdomain.tld sub1.otherdomain.tld sub2.otherdomain.tld
Expiry Date: 2018-06-12 14:51:38+00:00 (VALID: 81 days)
Certificate Path: /etc/letsencrypt/live/otherdomain.tld/fullchain.pem
Private Key Path: /etc/letsencrypt/live/otherdomain.tld/privkey.pem
so take the name shown on Certificate Name: and the domains it is covering in Domains: and you should re-issue the certificates but using the webroot authentication method (there is no need to stop/pause cloudflare).
certbot certonly --cert-name my.domain.tld -a webroot -w /path/to/your/document/root -d my.domain.tld
And you will get this question:
What would you like to do?
-------------------------------------------------------------------------------
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
You should use 2 and continue.
Note: This question will be asked only once so there would be no problems to renew.
If all is working as expected your certificate will be re-issued and the next unnatended renew should complete with success.
Just in case, following the example, the command for the second domain would be:
certbot certonly --cert-name otherdomain.tld -a webroot -w /path/to/your/document/root -d otherdomain.tld,sub1.otherdomain.tld,sub2.otherdomain.tld
or this one if the domains covered by the certificate are using different document roots:
certbot certonly --cert-name otherdomain.tld -a webroot -w /path/to/your/document/root -d otherdomain.tld -w /path/to/socument/root/sub1 sub1.otherdomain.tld -w /path/to/socument/root/sub2 sub2.otherdomain.tld
As I said, I'm just guessing, if your problem is not the tls-sni-01 challenge then we should review the errors you are getting to renew your certs.
I hope this helps.
Cheers,
sahsanu
