If the origin doesn’t check CloudFlare’s TLS cert, an invalid cert wouldn’t block a scanner like this.