Sorry for being late to the party. For postgresql you use use the same parameters (mostly) you'd use on the command line, through a configuration variable:
SQLALCHEMY_ENGINE_OPTIONS = {
"connect_args": dict(host=os.environ['POSTGRES_HOST'], user=os.environ['POSTGRES_USER'],
password=os.environ['POSTGRES_PASSWORD'], dbname=os.environ['POSTGRES_DB'],
sslcert="client.crt", sslkey="client.key",
sslrootcert="ca.crt", sslmode="verify-full", ssl_min_protocol_version="TLSv1.3")
}
Whenever you create the connection, these arguments will be picked up. You might have problems generating the self-signed ssl certificate for local testing: using names on the CN will prevent this connection line to succeed with 'verify-full'. In that case, the options are to revert to just 'require', to upgrade to 'verify-ca' (ca is verified but not hostname), or to generate the certificates with 127.0.0.1 (or the corresponding ip) everywhere... and then it will succeed with verify-full.