See video writeup here:
https://www.youtube.com/watch?v=50Vfl4H9zSY

Solution:
1.) Create SSH tunnel
2.) Find certificate on CT
3.) Setup HTTPS server to intercept flag