pg_basebackup with hostssl ?

I've had a quick glance through the man page for pg_basebackup but can't see any flags to set ssl.

Long story short, I've got the following in pg_hba.conf of the master:
hostssl    replication    all    10.0.0.0/8    md5

But the slave is complaining:
FATAL:  no pg_hba.conf entry for replication connection from host "10.1.2.3", user "myrepl", no encryption

I suspect this is almost certainly because I'm using "hostssl" instead of "host".

But other than the obvious and undesirable quick-fix, how should I be calling pg_basebackup to make sure it uses
encryption?