X_REPLICATION_TLS
Means
the replication connection failed TLS
Typical cause
the server certificate failed the verification the sslmode asks for (verify-ca: the chain; verify-full: the chain and the host name), sslrootcert names no readable file, or the TLS handshake itself failed
Fix
openssl s_client -starttls postgres -connect "$PGHOST:$PGPORT" -showcerts </dev/null shows the chain and names the server presents; then pass its CA with ?sslrootcert=/path/to/ca.crt, connect with a name the certificate lists, or use ?sslmode=require to encrypt without verifying