Authenticated Origin Pulls
Authenticated Origin Pulls allows you to verify that web requests to your origin server have come from CloudFlare as configured in your account. This prevents traffic from bypassing security measures provided by CloudFlare, such as IP and Web Application Firewalls, logging, and encryption.
When configured, CloudFlare origin-pull servers present a TLS client certificate as part of connections to your origin. Web servers and other infrastructure can be configured to require client certificate authentication for connections.
For more information, please see here.