Setup

• a primary/replica cluster with at least one replica
• another server that will be the external replication primary
• use something like

  CHANGE MASTER "ext-repl" TO

  MASTER_HOST = <sth>

  MASTER_PORT = <sth>

  MASTER_USER = <sth>

  MASTER_PASSWORD = <sth>

  MASTER_LOG_FILE = <sth>

  ASTER_LOG_POS = <sth>

  MASTER_SSL = 1;

  to set up replication between the cluster priamry and the external primary
  MASTER_USER and MASTER_PASSWORD should be the same as the ones used for the internal replication between primary and replica
  Note the "MASTER_SSL = 1", this is the important part

• start the replication and make sure it works and check the replication status. You should have "Master_SSL_Allowed: Yes"
• perform a manual switchover in maxscale

  maxctrl -u '<user>' -p '<pass>' call command mariadbmon switchover MariaDB-Monitor primary replica

• check the replication status on the new primary

expected
"Master_SSL_Allowed: Yes"

actual
"Master_SSL_Allowed: No"

If the external primary has been setup to only accept SSL connection (like with "require_secure_transport" or "require ssl"), replication will fail.

Same thing happens with failover.