I have a few Plone sites behind Cloudflare. Works fine. As far as I know, cloudflare requires switching over your DNS to them. They provide HTTPS so you don't really need a separate certificate, but I think you can keep using your own certificate as well. Not sure if the free service supports that though.