SSL SSL thing set up. It works. But is it really secure? Or I miss something important?

I just followed the information here piece by piece. And it actually works even though most of the time I have no idea I'm doing.

The problem is.. there are much more information that I couldn't follow because I was kind of lost.

Software: CentOS 7. latest beta CentminMOD.

DNS: Cloudflare Full (strict), HTTPS only, Auto HTTPS rewrites, TLS 1.3 enabled, Origin Cert created (CRT and KEY codes) using ECDSA, Authenticated Origin Pulls enabled

My server:
1) vhost created, SSL applied
2) /usr/local/nginx/conf/conf.d/mydomain.com.conf renamed to mydomain.com.conf-disabled
3) uncommented the following lines in mydomain.com.ssl.conf
server {
listen 80;
server_name mydomain.com www.mydomain.com;
return 301 https://$server_name$request_uri;
}

---

Show real IP of visitors instead of those from Cloudflare:

i. Uncomment the following line in /usr/local/nginx/conf/nginx.conf
include /usr/local/nginx/conf/cloudflare.conf;
ii. Run the following command:
/usr/local/src/centminmod/tools/csfcf.sh auto

Configure Cloudflare Authenticated Origin Pull:

Run the comments:

a) read -ep "enter vhost domain name you want to setup cloudflare origin pull for: " vhostname ;
b) mkdir -p /usr/local/nginx/conf/ssl/cloudflare/$vhostname ;
c) cd /usr/local/nginx/conf/ssl/cloudflare/$vhostname ;
d) wget https://support.cloudflare.com/hc/en-us/article_attachments/360044928032/origin-pull-ca.pem -O origin.crt ;
e) echo -e "ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/$vhostname/origin.crt;\nssl_verify_client on;" ;

Uncommented the following lines in /usr/local/nginx/conf/conf.d/mydomain.com.ssl.conf：

ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/mydomain.com/origin.crt;
ssl_verify_client on;

replace the content of 2 files mydomain.com.crt and mydomain.com.key in directory /usr/local/nginx/conf/ssl/mydomain.com with the CRT and KEY codes generated above (see DNS above).

Lastly, ngxrestart. The website shows SSL protected with the cert like below:



Cloudflare showing this:



So am I doing the best I can? Or is there something else I can do for better security and performance?

Thank you!