This is very hosting service-specific - some hosts will expose your server via a generated and wildcard cert encrypted connection (ex: Heroku and their appname.herokuapp.com).

CF also allows for self-signed certs: https://blog.cloudflare.com/origin-server-connection-securit... - which are (to me) more complicated than standard certs.

The real game changer in all of this is LetsEncrypt which has become the defacto option for services with huge amounts of custom domains (Shopify, Hubspot, Wordpress) etc.

It's complicated, but basically... You don't. It's much better to just set up Let's Encrypt. Takes <15 minutes.