It's exactly the same excepting that no CA will sign your CSR (it'll be a self-signed certificate) and it's mostly superfluous because .onion is already providing end-to-end authenticate encryption.
Update to address comments and updated question:
There is no difference between the approach over tor or a dangernet site, you'd setup something like:
HiddenServiceDir /var/lib/tor/onion
HiddenServicePort 80 8080
HiddenServicePort 443 4433
Then configure your httpd to 301 to https://$hostname for any requests on 8080, just as you would for a dangernet website.
If you're interested in client authentication then onion services can actually provide this, depending on your requirements and the size of your userbase, this would remove the requirement for a TLS stack on the server, clients setting TLS exceptions on their browser and installing a client-side TLS certificate.
To do this, you'd create a config like:
HiddenServiceDir /var/lib/tor/onion
HiddenServiceAuthorizeClient basic alice,bob,charlene,diane,edgar
HiddenServicePort 80 8080
HiddenServicePort 443 4433 # maybe irrelevant now?
Now you'd have a file in /var/lib/tor/onion/hostname that'd look like:
w27mu53v64gcpfru.onion Bq1T05QWOWhZG5/EN5oqfQ # client: alice
w27mu53v64gcpfru.onion n5I/fRj05aQG/2gqy1KC3g # client: bob
w27mu53v64gcpfru.onion rN+OCpC5ntgDGnCW0Quxpw # client: charlene
w27mu53v64gcpfru.onion 0K5Fd2zOiSo/Fc0t7YYgPQ # client: diane
w27mu53v64gcpfru.onion fu2LxUfA5QWxuC5PgEDSaQ # client: edgar
Now you give each user their "cookie", no one can access the hidden service without a valid "cookie". Alice, for example, would edit her torrc to include this line:
HidServAuth w27mu53v64gcpfru.onion Bq1T05QWOWhZG5/EN5oqfQ
Now Alice can use w27mu53v64gcpfru.onion as normal, and you'd know that the visitor was authorized because without their cookie they'd be unable to connect. If at any time you want to revoke access, you can remove Alice from the client list in the HiddenServiceAuthorizeClient line and reload tor to invalidate their cookie.
This is "basic" authorization for onion services, there is a further "stealth" but it does not scale anywhere near as well as basic because it published a descriptor for every client, each client uses a different .onion address to access the site too. It might be of interest if your userbase is small and high risk or high security. It also has some interesting extra security properties too, but it's going a bit beyond just replacing client-side TLS certificates.