The standard zabbix_sender, when used together with an agent configuration file, should directly support TLS connections.

From https://www.zabbix.com/documentation/3.2/manpages/zabbix_sender:

OPTIONS
-c, --config config-file
Use config-file. Zabbix sender reads server details from the agentd configuration file. By default Zabbix sender does not read any configuration file. Absolute path should be specified. Only parameters Hostname, ServerActive and SourceIP are supported. First entry from the ServerActive parameter is used.