Google now has a publicly available ACME-compatible CA. For CF’s Universal SSL (default/free) Cloudflare may use Google’s CA. But may choose other providers. For Advanced Certificate Manager (paid addon), you can choose Google or other CAs for Cloudflare.

But basically Google would be the one that is issuing an SSL cert for a website. Same as LetsEncrypt.

Disclaimer: CF employee

If your site uses Universal SSL ($0/month), Cloudflare automatically picks a CA for you (most likely Let's Encrypt).

The Advanced Certificate Manager ($10/month) SKU allows you to pick a CA. There are few other options available. https://developers.cloudflare.com/ssl/edge-certificates/adva...

My understanding is that you can now have TLS compatibility with all google products through https://pki.goog/

Tweet where I saw this: https://twitter.com/rmhrisk/status/1552357227301744640