Steps to reproduce:

1. Configure Agent 2 for a custom SQL script that takes a single parameter (e.g. SELECT status FROM status_table WHERE id=$1)
2. Create on Zabbix an item that uses an item like pgsql.custom.query["\{$PG.URI}","\{$PG.USER}","\{$PG.PASSWORD}","\{$PG.DATABASE}",status,1] (note the additional parameter after script name (remember to add a postprocessing JSONQuery step to extract status from JSON array returned by agent, e.g. $[0].status)
3. Check the result

Result:

An error is present on Agent log:

2022/02/05 07:16:57.185873 received passive check request: 'pgsql.custom.query["tcp://localhost:5432","test","password",
"test",status,1]' from '127.0.0.1'
2022/02/05 07:16:57.185966 [1] processing update request (1 requests)
2022/02/05 07:16:57.186000 [1] adding new request for key: 'pgsql.custom.query["tcp://localhost:5432","test","password",
"test",status,1]'
2022/02/05 07:16:57.186037 [1] created direct exporter task for plugin 'Postgres' itemid:0 key 'pgsql.custom.query["tcp:
//localhost:5432","test","password","test",status,1]'
2022/02/05 07:16:57.186101 executing direct exporter task for key 'pgsql.custom.query["tcp://localhost:5432","test","pas
sword","test",status,1]'
2022/02/05 07:16:57.186148 failed to execute direct exporter task for key 'pgsql.custom.query["tcp://localhost:5432","te
st","password","test",status,1]' error: 'Invalid parameters: "TLSConnect" cannot be passed as a key parameter.'
2022/02/05 07:16:57.186181 sending passive check response: ZBX_NOTSUPPORTED: 'Invalid parameters: "TLSConnect" cannot be
 passed as a key parameter.' to '127.0.0.1'

{}Expected:

Expecting the item to be filled with the correct value returned by the query

More information:

The above configuration works fine with Zabbix Agent 2 version 5.4.3.

Seems that ZBX-20475 didn't properly fix the regression introduced by the new TLS database connection handling of agent 2 version 5.4.4