@manavo, it looks like both zigzagger and www.zigzagger.io are now serving certs, so hopefully this means that our certs came through!
@tomasztomczyk: Yup, if you needed a wildcard domain, you’d need a DNS-01 challenge. Let’s Encrypt (our CA) won’t issue them otherwise.
Keeping Cloudflare’s proxied records on will prevent our TLS-ALPN-01 challenge from being completed successfully. which is what you’d be using without an _acme-challenge record. I’m not completely sure why these records seemed to be causing issues for your cases-- when I tried setting up records identical to yours (but with a different domain), it succeeded within a couple of minutes.
If you need Cloudflare proxying, It’s definitely worth a shot to try re-adding these records at some point, perhaps creating them with a TTL of 2-3 min and waiting to make sure they’ve updated globally with a tool like dnschecker.org or similar.