I just went though this. you need to whitelist the acme-challenge (using page rules) like this:

  *example.com/.well-known/acme-challenge/*
  Disable Security, SSL: Off, Cache Level: Bypass, Automatic HTTPS Rewrites: Off

and one big gotcha:

  Under SSL/TLS -> Edge Certificates -> disable Always Use HTTPS

(assuming you are using the HTTP-01 challenge).