Cloudflare Total TLS: one-click TLS for every hostname you have (blog.cloudflare.com)

Quite handy, but not part of the free tier. It's included with purchase of the Advanced Certificate Manager.

Total TLS is a one-click button that signals Cloudflare to automatically issue TLS certificates for every proxied DNS record in your domain. Once enabled, Cloudflare will issue individual certificates for every proxied hostname.