They probably meant to link https://developers.cloudflare.com/ssl/origin-configuration/a... where Cloudflare uses a client TLS certificate to pull from the origin and the origin should be configured to reject requests without a client certificate.