MySQL 5.7 Por que consigo conectar à origem, mas não replicar?

Estou tentando configurar a replicação entre dois servidores mysql 5.7. Consigo conectar à fonte a partir da réplica, mas quando tento iniciar a replicação, a réplica falha ao conectar à fonte. O que pode causar isso

Isso abre com sucesso um cliente mysql conectado à fonte:

# On replica
$ mysql -u [my_user] -p -h [source_host] \
    --ssl-mode=REQUIRED \
    --ssl-ca=/etc/[source_host].cabundle

Status da fonte:

mysql> show master status;
+------------------+----------+--------------+------------------+-------------------+
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |
+------------------+----------+--------------+------------------+-------------------+
| mysql-bin.002513 | 45687316 |              |                  |                   |
+------------------+----------+--------------+------------------+-------------------+
1 row in set (0.00 sec)

Na réplica:

mysql> CHANGE MASTER TO
    -> MASTER_HOST='[source_host]',
    -> MASTER_USER='[my_user]',
    -> MASTER_PASSWORD='[my_password]',
    -> MASTER_LOG_FILE='mysql-bin.002495',
    -> MASTER_LOG_POS=154,
    -> MASTER_SSL=1,
    -> MASTER_SSL_VERIFY_SERVER_CERT=0,
    -> MASTER_SSL_CA='/etc/ssl/[source_host].cabundle'
    -> ;
Query OK, 0 rows affected, 2 warnings (0.03 sec)

mysql> start slave;
Query OK, 0 rows affected (0.00 sec)

Status da réplica:

mysql> show slave stauts \G
*************************** 1. row ***************************
               Slave_IO_State: Connecting to master
                  Master_Host: [source_host]
                  Master_User: [my_user]
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: mysql-bin.002495
          Read_Master_Log_Pos: 154
               Relay_Log_File: [hostname]-relay-bin.000001
                Relay_Log_Pos: 4
        Relay_Master_Log_File: mysql-bin.002495
             Slave_IO_Running: Connecting
            Slave_SQL_Running: Yes
              Replicate_Do_DB: 
          Replicate_Ignore_DB: 
           Replicate_Do_Table: 
              Relay_Log_Space: 154
              Until_Condition: None
               Until_Log_File: 
                Until_Log_Pos: 0
           Master_SSL_Allowed: Yes
           Master_SSL_CA_File: /etc/ssl/[source_host].cabundle
           Master_SSL_CA_Path: 
              Master_SSL_Cert: 
            Master_SSL_Cipher: 
               Master_SSL_Key: 
        Seconds_Behind_Master: NULL
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 2026
                Last_IO_Error: error connecting to master '[my_user]@[source_host]:3306' - retry-time: 60  retries: 
4
               Last_SQL_Errno: 0
               Last_SQL_Error: 
  Replicate_Ignore_Server_Ids: 
             Master_Server_Id: 0
                  Master_UUID: 
             Master_Info_File: [mysql_dir]/master.info
                    SQL_Delay: 0
          SQL_Remaining_Delay: NULL
      Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates
           Master_Retry_Count: 86400
                  Master_Bind: 
      Last_IO_Error_Timestamp: 250115 03:03:38
     Last_SQL_Error_Timestamp: 
               Master_SSL_Crl: 
           Master_SSL_Crlpath: 
           Retrieved_Gtid_Set: 
            Executed_Gtid_Set: 
                Auto_Position: 0
         Replicate_Rewrite_DB: 
                 Channel_Name: 
           Master_TLS_Version:

mysql error.log na réplica:

[Note] 'CHANGE MASTER TO FOR CHANNEL '' executed'. Previous state master_host='[source_host]', master_port= 3306, master_log_file='', master_log_pos= 4, master_bind=''. New state master_host='[source_host]', master_port= 3306, master_log_file='mysql-bin.002495', master_log_pos= 154, master_bind=''.
[Warning] Storing MySQL user name or password information in the master info repository is not secure and is therefore not recommended. Please consider using the USER and PASSWORD connection options for START SLAVE; see the 'START SLAVE Syntax' in the MySQL Manual for more information.
[Warning] Slave SQL for channel '': If a crash happens this configuration does not guarantee that the relay log info will be consistent, Error_code: 0
[Note] Slave SQL thread for channel '' initialized, starting replication in log 'mysql-bin.002495' at position 154, relay log './analysis-relay-bin.000001' position: 4
[ERROR] Slave I/O for channel '': error connecting to master '[my_user]@[source_host]:3306' - retry-time: 60  retries: 1, Error_code: 2026

mysql error.log na fonte:

[Note] Bad handshake