Is github on your list?

You are probably using a VPS running on someone else server, through many networks. (So do I.) Any of those can MITM your traffic. Maybe you're also using apt/yum to keep the VPS up-to-date. Is adding Letsencrypt to the list such a burden? Or maybe you're only against Cloudflare. I go with Letsencrypt.

It's complicated, but basically... You don't. It's much better to just set up Let's Encrypt. Takes <15 minutes.

This is very hosting service-specific - some hosts will expose your server via a generated and wildcard cert encrypted connection (ex: Heroku and their appname.herokuapp.com).

CF also allows for self-signed certs: https://blog.cloudflare.com/origin-server-connection-securit... - which are (to me) more complicated than standard certs.

The real game changer in all of this is LetsEncrypt which has become the defacto option for services with huge amounts of custom domains (Shopify, Hubspot, Wordpress) etc.