Traffic is only encrypted/secure between your visitor and Cloudflare's servers, but then unencrypted between Cloudflare and your server... you actually still need your own (separate) SSL certificate on your own server in order for the connection between Cloudflare and your server to be encrypted as well.
So, if security is your goal, I very strongly recommend using LetsEncrypt over Cloudflare (or use both together if you need the CDN/anti-DDOS services Cloudflare offers.)
You can find more details/specifics about it here and here.
Cheers
