It might help if you could say more about your Postgres instance, why TLS is a hard requirement in this context, and the full details of the connection strings have been tried so far: both the cases that succeeded and the cases that failed.
(* out any passwords, of course—and feel free to do the same for any names that you consider sensitive—but show the full structure.)
It’s unusual to use TLS to talk to Postgres within the 6PN, so it may not be the tunnel itself that’s at fault…