Candlepin on external PostgreSQL Database with SSL

Trying to upgrade foreman with foreman-maintain upgrade check --target-version xyz

/usr/share/candlepin/liquibase.sh --driver=org.postgresql.Driver --classpath=/var/lib/tomcat/webapps/candlepin/WEB-INF/lib/postgresql-42.2.2.jar:/var/lib/tomcat/webapps/candlepin/WEB-INF/classes/ --changeLogFile=db/changelog/changelog-validate.xml --url=“jdbc:postgresql://1.2.3.4:5432/candlepin\?ssl\=true” --username=katello --password=katello --logLevel=debug migrate -Dcommunity=False
Nov 16, 2021 9:57:32 AM org.postgresql.core.v3.ConnectionFactoryImpl log
WARNING: SQLException occurred while connecting to 1.2.3.4:5432
org.postgresql.util.PSQLException: FATAL: no pg_hba.conf entry for host “1.2.3.4”, user “katello”, database “candlepin\”, SSL off
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:473)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:205)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
at org.postgresql.jdbc.PgConnection.(PgConnection.java:195)
at org.postgresql.Driver.makeConnection(Driver.java:452)
at org.postgresql.Driver.connect(Driver.java:254)
at liquibase.database.DatabaseFactory.openConnection(DatabaseFactory.java:223)
at liquibase.database.DatabaseFactory.openDatabase(DatabaseFactory.java:141)
at liquibase.integration.commandline.CommandLineUtils.createDatabaseObject(CommandLineUtils.java:52)
at liquibase.integration.commandline.Main.doMigration(Main.java:788)
at liquibase.integration.commandline.Main.main(Main.java:133)

Konfiguration looks like:
foreman-installer --scenario katello --tuning default --foreman-initial-organization “TESTORG” --foreman-initial-location “TESTLOC” --foreman-initial-admin-password “testTEST”
–foreman-proxy-puppet false --foreman-proxy-puppetca false --foreman-proxy-logs false
–katello-candlepin-db-host 1.2.3.4 --katello-candlepin-db-password katello --katello-candlepin-db-port 5432 --katello-candlepin-db-ssl true
–katello-candlepin-db-ssl-verify true --katello-candlepin-db-user katello --katello-candlepin-manage-db false
–foreman-db-database foreman --foreman-db-host 1.2.3.4 --foreman-db-password katello --foreman-db-port 5432 --foreman-db-sslmode prefer --foreman-db-username katello
–foreman-proxy-content-pulpcore-manage-postgresql false --foreman-proxy-content-pulpcore-postgresql-host 1.2.3.4 --foreman-proxy-content-pulpcore-postgresql-password katello
–foreman-proxy-content-pulpcore-postgresql-ssl true --foreman-proxy-content-pulpcore-postgresql-user katello --foreman-proxy-content-pulpcore-postgresql-ssl-require true