Further TLS upgrade error message improvements

 * Include connection string
 * Slightly more specific messages for handshake failure and other TLS alerts
Special case TLS alert "unknown CA", which is very common

Indicates a generic certificate verification problem, which we mention.