pgbouncer and ssl connection
TLS between pgbouncer and server is not enabled through the connect string, but with server_tls_sslmode, which is disabled by default.

It should be set to at least prefer, and also some of the other server_tls_* parameters might be needed to, depending on the TLS configuration at the other end.

See https://pgbouncer.github.io/config.html#tls-settings for all the details.