If you're seeing this through the public WAF (not by hitting 127.0.0.1:8443 directly), the WAF successfully authenticated to this upstream with its client certificate.