See video writeup here: https://www.youtube.com/watch?v=50Vfl4H9zSY

Solution: 1.) Create SSH tunnel 2.) Find certificate on CT 3.) Setup HTTPS server to intercept flag