You may have an issue with the SNI config. SNI will check the CN and SAN attributes. Your cert generation commands use O=localhost and CN=root.
I suggest removing as many variables as possible from the problem space, confirm a working connection, and then start adding those variables back in slowly.
In this case, I recommend using openssl s_client on the command line to connect to postgres directly (just a TLS socket connection), removing Elixir from the equation for now. Once you have that working you can try to match the Elixir config to the s_client arguments.
