Workaround is eay, but I want every [client] enforcing SSL.
I am asking to backport https://bugs.mysql.com/bug.php?id=74864 to MariaDB. It should be relatively straightforward, as it is a client-only change. Although later, code was refactored in 5.7 with different option meanings.
As far as I can see, the diff where this was fixed in 5.7 is: https://github.com/mysql/mysql-server/commit/53ab9bcbfb3e2f908e7dcf48d258ec2fc5d47b8c#diff-adaf67317429b2bcbbb7426654beff2f although the code was later refactored in newer 5.7 versions ( https://github.com/mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390#diff-adaf67317429b2bcbbb7426654beff2f ).