Short answer
HubSpot's KB on updating DNS records, for Cloudflare: set Proxy status so the orange cloud turns grey, which lets HubSpot recognize the record. HubSpot also recommends a screenshot of your DNS settings before changes. Proxying through Cloudflare is a reverse proxy setup; Cloudflare Enterprise can use Orange-to-Orange.
1. Hosting domains
Connected domains in my demo portal.

2. SSL
See SSL provisioning.