no prompt for client certificates?

I have mTLS enabled for my domain, together with a WAF rule that blocks non-mTLS authenticated requests, and installed a cloudflare issued client certificate on my machine.

however when i try to visit my site using chrome or firefox the window to select a certificate to present never opens, and i just get blocked.

is there a configuration step for mTLS that i've missed?