CloudFlare

Make sure after you create the A record with the IP to your host and the CNAME record for portainer that you also click the clouds to make sure they turn grey. The will allow letsencrypt to grab the certs required. Orange clouds will continue to fail as Cloudflare will black the auth requests for certs.