Got HTTPS working on my new DO droplet with nginx and cloudflare, it turned out I had to switch a Cloudflare SSL setting from "Flexible" to "Strict".