The error says it

Unable to get private key from '/etc/ssl/wildcard.key'

Do you have such a file? Does it have a valid private key?

This is likely the effect of MDEV-29811 — in previous releases the server ignored incorrect SSL setup and, depending on the client config, it was either pretending to be more secure than it was or it was impossible to connect to altogether.

Now the server refuses to start if the SSL was configured incorrectly, if SSL was requested, the server will not start without it.

Yes - file is at this path, was used by the service before.

Also it is used by other services like postfix - so I can confirm the certificate is valide and also my mailclient works with it.

Permission are for All readable (ugo+r).
In kernel and last log is nothing that indicates this error. apparmore is not active for this service.

Greetings
Christian

Do you use distro mariadb packages? They might be compiled with yassl, and yassl can refuse to load keys that openssl can. You've always had this error, just after in 10.3.37 it became visible, earlier versions simply disabled SSL and pretended than everything's fine, and 10.3.37 refuses to lie about it.

Search for "Unable to get private key" — I've got quite a few hits, both for MariaDB and MySQL, for older versions too. For example, https://bugs.mysql.com/bug.php?id=71271

Same happened when upgrading from 10.5.15-0+deb11u1 to 10.5.18-0+deb11u1 on Debian 11. This is a really critical bug as our configs (managed through Puppet) include ssl = false in the config, so naturally one would expect that the ssl-cert etc. parameters would be ignored. For a patch update to change such a functionality to bring down all MySQL servers is not ideal.
I also tried skip-ssl and ssl = 0 but none of these options helped letting the server start up.

I have just tested this and indeed, the server still tries to activate ssl (even if

ssl = false

or

skip-ssl

is used and further ssl directives are in the configuration file:

[client-server]

ssl = false

skip-ssl

[...]

ssl-ca = /etc/mysql/cacert.pem

ssl-cert = /etc/mysql/server-cert.pem

ssl-key = /etc/mysql/server-key.pem

I am not sure if this is on purpose though, my understanding from https://mariadb.com/kb/en/mysqld-options/#-ssl is that

skip-ssl

should disable any further ssl options but it also mention

automatically enabled with other flags

?

Anyway, I have forwarded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1026353 to this jira issue and regarding the puppet deployment tool, this comment is correct, there is no reason to deploy extra ssl directives if it's supposed to be disabled in the first place IMO.

This was also related to https://bugs.launchpad.net/ubuntu/+source/mariadb-10.3/+bug/1997916 and MDEV-29811