After upgrading I couldn't get the cluster running anymore.
Logs say:

WSREP: Failed to initialize parameter 'socket.ssl_cipher', value AES256-SHA , flags (read_only | bool)

The setting appears to have a valid value and this config (see attached file) worked in 10.11.
If I remove socket.ssl_cipher from the wsrep_provider_options completely, everything starts working again, but this is obviously not a desirable solution.

It appears I'm not the only one experiencing this issue:
https://github.com/codership/galera/issues/656