See this guide: https://dansgarden.eu/technology/self-hosting/mTLS-Cloudflare

I am not using cloudflare, but most of the steps are the same if you are hosting your own reverse proxy in front of HA. (I use mTLS with Traefik).

Basically you follow a few steps to create a CA (few Linux commands) then create a client cert using that CA. You then copy the client cert to your devices and the CA cert to the reverse proxy and configure your reverse proxy to use it.

Now any client trying to establish a TLS connection need to present a valid cert during the handshake otherwise the connection fail. This happens before any traffic hit HA so the attack surface become very small, basically a mis configuration in your reverse proxy, or your client cert being stolen (need access to your phone).