MySQL [Bad handshake] error after update
MySQL 5.7.28 dropped support for yaSSL. On some platforms, such as RHEL and presumably Ubuntu, that resulted in a change from yaSSL to OpenSSL. There are a variety of things that would have worked under yaSSL but no longer work under OpenSSL. For example, yaSSL could not handle certificate chains, but OpenSSL both sends and verifies full chains.
Among other troubleshooting techniques, try taking a packet capture of the TLS handshake with tcpdump and decoding it in Wireshark.