CDN to Origin Certificates
Even if you are using a CDN, you still need to manage certificates on your origin server (or load balancer). The common rule for CDNs is: if they receive encrypted traffic, they will transmit encrypted traffic to the origin. Fair enough.
While some CDNs offer options to send traffic to a plain HTTP port (like port 80 on Cloudflare or the deprecated “protocol downgrade” on Akamai), this is not recommended. Therefore, your origin server should be configured to handle encrypted HTTPS traffic.