Best Practice for Certificate Authentication

You need to clarify whether you are talking about your client authenticating to a server (which is not very common), or a server authenticating to your client, which must always happen.

Are you creating an application to handle certificates or are you adding tls to your client to serve a python app written in Flask/FastApi/Django?

If the last option, use option 3. but use an apache/nginx proxy and preferably an Acme client like certboot/acme.sh to handle the updates.

In apache you use ProxyPass and ProxyPassReverse to map you myapp running on:

http://<internal-ip>:8080 to https://<your tls domain>/myapp

  ProxyPass /myapp http://<internal-ip>:8080/myapp
  ProxyPassReverse /myapp http://<internal-ip>:8080/myapp

• Apache Example - https://gist.github.com/diyfr/078fb10082589115df48039f42dce7e3
• Nginx example - https://gist.github.com/gmolveau/5e5b0bd2773100d85d9302d0fa96632d

If you use a fixed certificate then just skip the acme update part. But you then have to handle it manually when it expires in max 3years.

Using a proxy adds benefits like ratelimiting, filtering, logging, security scanning etc. Performance wise You needs lots of python apps to flood a apache or nginx proxy.

@President James K. Polk thanks for the clarifying question, I worded it poorly. In this case it's the server authenticating to our client application, where we get a 'unable to get local issuer certificate' error if the certificate is not referenced in the call.