How do I debug/set up MariaDB SSL connection?
A good start is to use the openssl s_client command. You will need a fairly new version of openssl (1.1.0) - see https://serverfault.com/a/931652/317638 for more info.

Then you must remember -starttls mysql :

  openssl s_client -connect YOURHOSTNAME:3306  -CAfile /etc/mysql/cacert.pem  -starttls mysql