It took some time before realising that client certs and keys can be specified on the connection uri while setting config values. Like this:
SQLALCHEMY_DATABASE_URI: mysql://user:password@hostname/db?ssl_key=ssl/client-key.pem&ssl_cert=ssl/client-cert.pem
Where ssl/ is a relative path from the calling app.
Later on you can confirm that the connection really was over ssl with something like:
res = db.session.execute("SHOW STATUS LIKE '%ssl%'")
for r in res:
print r
You’ll then see some info regarding your connection.