It seems Cassandra 3.11.8+ requires a newer version of TLS. Forcing it in cqlsh
client configuration should help (see How to force SSL TLSv1.2 protocol with DSE).
[connection](...)factory = cqlshlib.ssl.ssl_transport_factoryssl = true[ssl](...)version = SSLv23