How do I debug/set up MariaDB SSL connection? [ I originally posted this on ServerFault but then was pointed at this community ]

Since moving from MySQL to a newer MariaDB installation on Debian 9, I a struggling with SSL connections.

I have created a CA certificate and installed it on both server and client. I then have created server and client keys and certificates that I signed with the CA certificate. 

What works:

I can connect from the client to the server with the mysql client without SSL connections.

I can verify the client certificate with openssl:

$ openssl verify MariaDB_client.crt 

MariaDB_client.crt: OK


I understand that MariaDB uses yaSSL, but this still shows that the certificates and CA are correct, I think.

On the server, I have:

MariaDB&gt; show global variables like '%ssl%';
+---------------------+--------------------------------------+
| Variable_name       | Value                                |
+---------------------+--------------------------------------+
| have_openssl        | NO                                   |
| have_ssl            | YES                                  |
| ssl_ca              | /etc/mysql/conf.d/MariaDB_ca.crt     |
| ssl_capath          |                                      |
| ssl_cert            | /etc/mysql/conf.d/MariaDB_server.crt |
| ssl_cipher          |                                      |
| ssl_crl             |                                      |
| ssl_crlpath         |                                      |
| ssl_key             | /etc/mysql/conf.d/MariaDB_server.key |
| version_ssl_library | YaSSL 2.4.4                          |
+---------------------+--------------------------------------+


What does not work:

If I add a .my.cnf file with the following content to the users $HOME directory...

[client]
ssl-ca=/--path--/MariaDB_ca.crt
ssl-cert=/--path--/MariaDB_client.crt
ssl-key=/--path--/MariaDB_client.key


...the connection fails with: 

ERROR 2026 (HY000): SSL connection error: unable to verify peer checksum


In the server log, I find (not sure whether this is related):

[Warning] IP address 'ip.of.connecting.client' could not be resolved: Name or service not known


My questions:


How can I narrow down/debug this connection problem?
I found conflicting information about whether I should use the same or different CN for the server and client certificates. Currently, I use the same CN.
Are there particular access rights required for the certificates?
A good start is to use the openssl s_client command. You will need a fairly new version of openssl (1.1.0) - see https://serverfault.com/a/931652/317638 for more info.

Then you must remember -starttls mysql :

  openssl s_client -connect YOURHOSTNAME:3306  -CAfile /etc/mysql/cacert.pem  -starttls mysql