Easiest will be to disable ssl on discourse side and let cloudflare manage ssl for you but that’s not okay at all times.
What I’ve done in my case is that I run discourse behind an nginx reverse proxy with letsencrypt ssl (in dns-01 with cloudflare dns plugin) and that makes it so that:
discourse (sockets) > nginx (ssl) > Cloudflare (ssl) > Public