The wsrep_sst_rsync script checks four different ssl_mode settings:

• DISABLED (or unset) - do not use encryption
• REQUIRED - make sure encryption is used
• VERIFY_CA and VERIFY_IDENTITY set different certificate verification modes

A closer look at the SST scripts though shows that only the rsync scripts treats both VERIFY modes as different, while the mariabackup script just enables general verification when seeing a mode starting with VERIFY, not checking the rest of the string then and so not making a difference between VERIFY_CA and VERIFY_IDENTITY