Hosting behind Cloudflare, with certificates that still work
Connect a scoped Cloudflare API token and Dashmox proves a domain through DNS instead of over HTTP. That is what a wildcard certificate needs, and it is what lets a certificate be ready before the domain points at the server at all.
Two things HTTP cannot do
Why the token is worth connecting.
Hosting behind Cloudflare works without any of this: point the DNS at the server and the site is served. Connecting a token is what adds the two things proof over HTTP cannot do.
A wildcard certificate
One certificate for every subdomain of a name. A certificate authority will only issue one when the domain is proved through DNS, which means something has to write a record.
A certificate before the move
Issue the certificate while the domain still points at the old host, then switch. The site is served over HTTPS from the first second rather than from whenever the certificate catches up.
Records without leaving the panel
The records a website needs can be written into the Cloudflare zone from here, so adding a name is not two tabs and a copied value.
The token
A scoped token, never a Global API Key.
What Dashmox asks for is an API token limited to editing DNS in the zones you choose. It is not a Global API Key, which would be a credential over your whole Cloudflare account held by a hosting panel, and the panel does not offer that as an option.
The token is not kept in the panel's database alongside everything else, and a customer's own zone stays theirs: a token belongs to the account that added it and reaches the zones that account named. The Cloudflare guide has the four steps, which take about three minutes.
Being honest about it
This is Cloudflare only.
All of this is about hosting behind Cloudflare specifically.
DNS proof here works with Cloudflare and nothing else. If your DNS is at a registrar or another provider, certificates are proved over HTTP as they always were, which works for an ordinary name and cannot do either of the two things above. That is a limitation worth saying out loud rather than discovering after choosing.
If you would rather this server hosted the DNS itself, it can: its own nameservers, its own zones, and the same two abilities without anybody else's token. That is a different arrangement with its own trade-offs, and the DNS guide covers both.
Proxied names keep working as proxied names. A certificate on this server is what the connection between Cloudflare and the server uses, which is the connection you want encrypted and the one that is nobody's business but yours.
Your servers, with nothing on them counted.
The whole panel is free on one server, with no limit on websites, mailboxes, DNS zones or customer accounts. Pro, for up to five servers, is not available yet.