AWS IOT Core custom domain cloudflare certificate

Hi

I have imported a Cloudflare SSL certificate into ACM that I already use with API Gateway.
The certificate has the following CN and SANs:
Common Name: CloudFlare Origin Certificate
Subject Alternative Names: *.domain.com, domain.com

I am trying to set up a "Customer managed domain" in AWS IOT Core.
For the domain name I am using: mqtt.domain.com (which is valid based on the SAN)
For the Server certificate, I am selecting the imported Cloudflare Certificate.
The validation certificate is left unselected.

However, when I try and create it, I get the following error:
CertificateValidationException
Common Name is not a valid Domain Name

Best, Brandon