It took some time before realising that client certs and keys can be specified on the connection uri while setting config values. Like this:
Where ssl/ is a relative path from the calling app.
Later on you can confirm that the connection really was over ssl with something like:
res = db.session.execute("SHOW STATUS LIKE '%ssl%'")
for r in res:
You’ll then see some info regarding your connection.