It looks like the client has changed the “failure logic”
[MDEV-28634] Client's --ssl-* options (without --ssl-verify-server-cert) are silently ignored if TLS is not possible - Jira
>> The client will only see an error if they also provide the --ssl-verify-server-cert option:<<
I believe the correct fix would be to set sslMode=disabled in the connection from Kodi - as in https://mariadb.com/kb/en/using-tl…java-connector/ (will be the same with c connector I believe)
By default when sslMode is set (not disabled), connector will use "serverSslCert" is set or the default truststore if not. Using default truststore can be disable setting option "fallbackToSystemTrustStore" to false.