2. After activating one of the SSL options, you would want to choose the Flexible option for SSL on the settings' page for the domain (settings->Cloudflare Settings->Settings Overview->SSL->Change to Flexible)
You can alternatively get to the page for SSL settings by going to:
Note: Do not choose the Full option.
Note -- As of May 2013 -- Google does not allow for using a CNAME at the root for Google App Engine. This means you cannot run a Google App Engine app at the root/zone apex/naked domain. Your Google App Engine app can be served from a locatiod like http://www.yourdomain.com or http://appid.yourdomain.com.
For instructions on how to configure a redirect for your Google Apps domain, please see the article on URL forwarding. --> http://support.google.com/a/bin/answer.py?hl=en&answer=61057