FWIW my server, like Morgans CPanel, offers free SSL through a provider (CPanel does it themselves, I think it's a custom LetsEncrypt system, whereas Virtualmin uses LetsEncrypt); but, iirc, they require a callback to be made which doesn't happen over existing SSL certs (such as CF)...
I run only CloudFlare for my SSL/HTTPS, and have never had a need to "turn it off" for any reason (doing so would expose my server IP address to spammers and bots).