✅ Your Requirements:
- 🔒 Ports 80/443 are firewalled to Cloudflare IPs only
- ☁️ You're behind Cloudflare, so Let's Encrypt (Certbot) cannot reach port 80 directly
- 🌐 You're using Apache, not Nginx
- You already have a self-signed or manually managed cert in use