Let's Encrypt can't issue a certificate until the domain is reachable. Ordinarily you would accept the self signed certificate, complete the setup then wait for the auto Let's Encrypt certificate to issue or expedite this by requesting it from the UI. The only reason you wouldn't be able to accept the self signed certificate is if the parent domain has HSTS enabled.
If you want to use the CloudFlare proxy, you can set the SSL mode in Cloudflare to permissive and complete the setup. From there you can request a Let's Encrypt certificate or install the Cloudflare origin certificate and you can then set the SSL mode back to strict. Bear in mind the Cloudflare proxy might interfere with some operations in the panel.
