Is this a certificate issue? Jellyfin works on browsers, but not apps.

Running an Ubuntu Linux box with docker containers for Jellyfin, portainer, and the cloudflare tunnel. (I know that's against ToS for the free version, but this is just proof of concept for now). Goal is to present my media server to extended family over the internet. The cloudflare tunnel imposes an identifier before getting to my origin server, and that seems like a reasonable basic security measure. (I'm using Google's identifier if that matters) Any type of browser can get to my published address, hit the google identifier (which I whitelist users for) and run jellyfin as intended. The whole time the browser shows "Connection secure". But when I try to put my published address (jellyfin..com) into the server field of the Jellyfin app (tried on shield, apple tv, and iphone) I get 'unable to connect' and 'Connection timed out' errors. All I'm hoping to find out is if this sounds like a certificate issue to those with stronger magic than myself. That's the avenue I'm exploring now, but certificates are just another complication to this project which is already stretching my abilities. Should I start my masters thesis on certificates, or does this sound more like a basic networking issue, like I don't have the right ports opened or something? Or something else. TIA