Yeah, TLS-ALPN validation requires that LetsEncrypt is able to negotiate TLS directly with Caddy. When there’s a Cloudflare proxy in the way, it can’t talk TLS to Caddy at all; it talks to Cloudflare, and Cloudflare talks to Caddy.
You either need an alternative method of validation, or you need an alternative way to get a certificate, or you need to remove the requirement for a certificate.
HTTP validation will work through Cloudflare. If Caddy is given enough time it should eventually try this and succeed. That said, it would probably be prudent to tell Caddy not to bother trying ALPN validation at all so it doesn’t waste time and resources.
Alternatively, if you’re not planning on having anyone connect directly to the server (i.e. you’re having all traffic route through Cloudflare), you don’t actually need a publicly trusted certificate. You just need a certificate that Cloudflare will trust. The link you provided details that under the heading 1. Using Cloudflare’s origin certificate. You can also combine that with Authenticated origin pull, also documented in that link, to ensure that non-Cloudflare clients aren’t connecting to your server.
And finally, last and certainly the least best option, you can use self-signed or even HTTP and relax Cloudflare’s strictness to make the above workarounds unnecessary. This is obviously much, much less secure.