I'm using CloudFlare's flexible SSL:
Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access your site over HTTPS, but connections to your origin will be made over HTTP. Note: You may encounter a redirect loop with some origin configurations.
The reason I'm using it is simple: I can't afford paid SSL certificate and using Let's Encrypt doesn't seem great, due to the need for an update the certificate each 90 days.
I have several concerns about CloudFlare SSL and the HSTS use with anything that works as CloudFlare's flexible SSL(user-cloudflare with HTTPS, cloudflare-myServer with HTTP). How exactly in cases like this(http-CDN-https) security achieved with HSTS, or is it not?
Any additional explanations and recommendation would be highly appreciated.