Does MySQL or MariaDB have a master option to strictly require TLS for ALL connections, no matter what?
As of MySQL 5.7, it does not seem to be possible to force SSL from the server side, without specifying it for each user. 

https://dev.mysql.com/doc/refman/5.7/en/encrypted-connection-options.html#option_general_ssl-mode


  --ssl-mode=mode
  
  This option is available only for client programs, not the server. It specifies the security state of the connection to the server. These option values are permitted:


BOO.  You can only force SSL from the client side.  Opposite of what you want to do.  This is likely why you're getting "bad option" trying to use it as a server setting.    

Also:


  To require use of encrypted connections by a MySQL account, use CREATE USER to create the account with a REQUIRE SSL clause, or use ALTER USER for an existing account to add a REQUIRE SSL clause. Connection attempts by clients that use the account will be rejected unless MySQL supports encrypted connections and an encrypted connection can be established.


Enforcing users to Require SSL by routinely checking the users table for REQUIRE SSL seems hacky, but it might be your best option.