When you point a subdomain to external hosting, the record needs to be set to DNS only (grey cloud) at first.
Why this happens. With DNS only, SSL certificate validation can reach the hosting server directly.
What you can do. After your hosting provider issues the SSL certificate, you can switch the record to Proxied (orange cloud) if you want Cloudflare’s proxy in front of it.