Tunnel.

How to make Cloudflare Origin certificates work

By installing Cloudflare's Origin Root CA certificate on the origin server