TLS encryption with a self-signed PKI and Python’s asyncio module
Since I stumbled on this checking something else, a few minor points


A CA doesn't sign a CSR; it signs (issues) a cert that has some important data taken from the CSR but much data different.
The Subject names of the CA cert and all server and client certs it issues should be unique, and preferably mnemonic. The CA and client names don't need to be FQDNs, or domainnames at all, although if they are FQDNs that helps make them unique, and usually mnemonic. For a server, either the CommonName part of the Subject or the SubjectAlternativeName extension if used should -- and for many but not all clients must -- match the 'hostname' used by the client(s) to connect to the server. Normally this is the FQDN, but in test and intranet settings it might not; your example shows connecting to the loopback or 'localhost' address 127.0.0.1.
ECDH-AESGCM is not a ciphersuite or even a keyexchange in SSL/TLS; ECDH+AESGM is an OpenSSL shorthand for 8 different cipher suites -- only 2 of which work with an RSA key+cert, namely ECDHE-RSA-AES256-GCM-SHA384 and ECDHE-RSA-AES128-GCM-SHA256.
You don't visibly specify the temporary (ephemeral) ecdh parameters (curve) so you are presumably getting a default from Python; OpenSSL itself doesn't have a default, although 1.0.2 up has a nondefault option to automatically use the client preference.
Since you've chosen everything else pretty strong, you should make sure the ECDHE curve isn't unacceptably weak. I would hope it can be found in the Python source; if not, monitor an actual connection with Wireshark or similar to check.