Questions about SSL certs with Postgres

Hi All,
I need a help to enable the SSL for my postgres cluster
I am using zalando postgres
My application is running as a pod and accessing the postgresDB
I have deployed postgresDB from zalando. My configuration is 1Master + 1 Slave . I mean number of replication is 2
I have added the below rule on pg_hba.conf through CRD

hostssl all all 10.233.0.0/15 md5 clientcert=1

My application pod and postgres pod are on same IP range (10.233.0.0/15)
When the slave postgres trying to sync with master postgres, I am getting the below error on Replica...

2020-07-23 11:28:41,944 INFO: Lock owner: postgres-cluster-1; I am postgres-cluster-0
2020-07-23 11:28:41,980 INFO: running pg_rewind from postgres-cluster-1
2020-07-23 11:28:42,024 ERROR: Exception when working with leader
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/patroni/postgresql/rewind.py", line 59, in check_leader_is_not_in_recovery
    with get_connection_cursor(connect_timeout=3, options='-c statement_timeout=2000', **kwargs) as cur:
  File "/usr/lib/python3.6/contextlib.py", line 81, in __enter__
    return next(self.gen)
  File "/usr/local/lib/python3.6/dist-packages/patroni/postgresql/connection.py", line 43, in get_connection_cursor
    with psycopg2.connect(**kwargs) as conn:
  File "/usr/lib/python3/dist-packages/psycopg2/__init__.py", line 127, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
psycopg2.OperationalError: FATAL:  connection requires a valid client certificate
FATAL:  pg_hba.conf rejects connection for host "10.233.65.89", user "postgres", database "postgres", SSL off

How others are enabling the SSL certs for app pod...
In kubernetes Pod IP cant be choosen by user. Either flannel or calico NW plugin will choose it
based on the range choosen by the user at the time of installation
How to avoid replica pod to sync with master without any problem when SSL certs were enabled?
Request to provide the guidance

Start with the pg_hba.conf rule supplied through the CRD, then inspect Patroni's postgresql/rewind.py and postgresql/connection.py paths shown in the traceback. Reproduce the replica-to-master connection and determine what configuration is needed for replication and pg_rewind to use a valid client certificate; done means the replica syncs without the SSL-off or certificate errors.