I managed to fix this, inadvertantly by fixing another issue for Proxmox Backup Server. If Authentik is using a self signed certificate, or you're running a self signed CA, you need to add the CA cert to the known CA's on each PVE host.
place the CA cert here: /usr/local/share/ca-certificates/custom_ca.crt
// execute on command line
update-ca-certificates
In addition, you MIGHT get the error with redirection once you've got to authentik. Make sure you remove the trailing / from your URL's in the Redirect URI's section within Authentik/Providers.
I'm happy to share my config info via PM if you need a hand