I moved ssl-ca, ssl-cert and ssl-key under the [mysqld] section and it works for me
[mysqld]
server-id=1
datadir=/var/lib/mysql
socket=/var/run/mysqld/mysqld.sock
log-error=/var/log/mysql/error.log
pid-file=/var/run/mysqld/mysqld.pid
innodb_autoinc_lock_mode=2
binlog_format=ROW
binlog_expire_logs_seconds=604800
ssl-ca=/etc/mysql/certs/ca.pem
ssl-cert=/etc/mysql/certs/server-cert.pem
ssl-key=/etc/mysql/certs/server-key.pem
wsrep_provider=/usr/lib/galera4/libgalera_smm.so
wsrep_cluster_address=gcomm://192.168.0.50,192.168.0.51,192.168.0.52
wsrep_slave_threads=4
wsrep_log_conflicts
wsrep_node_address=192.168.0.50
wsrep_cluster_name=pxc
wsrep_node_name=pxc-node-1
pxc_strict_mode=PERMISSIVE
wsrep_sst_method=xtrabackup-v2
pxc_encrypt_cluster_traffic = ON
wsrep_provider_options="socket.ssl=yes;socket.ssl_key=/etc/mysql/certs/server-key.pem;socket.ssl_cert=/etc/mysql/certs/server-cert.pem;socket.ssl_ca=/etc/mysql/certs/ca.pem"
[sst]
encrypt=4