I doubt you'll ever get CF proxy working with the current broker config, as CF does not pass through SSL connections. It terminates the connection and sets up a new one. So client side cert will not work and probably not even if port 443 is used. CF is meant as CDN for web traffic and DDOS protection.