The Let's Encrypt Certbot does this automatically for nginx and apache as well, just with a bit of extra config: https://certbot-dns-cloudflare.readthedocs.io/en/stable/