Cloudflare's OpenSSL patch for ChaChaPoly doesn't apply cleanly on OpenSSL 1.0.2i. This minor patch fixes it:
cd openssl-1.0.2i
wget https://gist.githubusercontent.com/charlesportwoodii/9e95c6a4ecde31ea23c17f6823bdb320/raw/a02fac917fc30f4767fb60a9563bad69dc1c054d/chacha.patch
patch < chacha.patch