When using a MariaDB server built against a current version of OpenSSL and connect to it using the command line client from the same version, using encryption, the client and server agree on using TLS v1.3 and TLS_AES_256_GCM_SHA384 as the cipher.

When doing the same with a generic binary tarball release, or on Windows, so that the server uses WolfSSL instead of OpenSSL TLS v1.3 and TLS13-AES128-GCM-SHA256 is used. The variant with 256bit AES and 384bit SHA is also offered by the client, but the server decides to use the "lesser" alternative.