Appears good for me, tested with testssl.sh [1]. Here is the fingerprint I see in the event you may have a MitM issue.
openssl s_client -servername dash.cloudflare.com -connect dash.cloudflare.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=23:80:59:61:1E:82:7F:85:96:5F:06:38:D1:7F:C0:19:7C:D1:90:07
#sha256
openssl s_client -servername dash.cloudflare.com -connect dash.cloudflare.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin
sha256 Fingerprint=A8:F7:20:54:02:B2:61:0A:1C:1E:21:D7:64:79:A9:EA:05:7B:AE:BF:11:FD:78:C5:F9:68:BB:EB:F4:7F:69:6A
Tested both IPv4 and IPv6, same results.[1] - https://github.com/drwetter/testssl.sh