OK, looks like we are good. I waited a while and I'm definitely seeing cloudflare IP for my site. Cloudflare proxy is turned ON and SSL/TLS in Cloudflare is set to Full (strict). Certbot dry run says it is happy still.
Thank you everybody!
2 Likes