I realize this is strange behaviour and I wonder if it is supposed to be working that way when using SQL Server generated self-signed certificate.
Client (Management Studio) with "encrypt connection" option set, client will verify self-signed cert on SQL Server side and fail because the self-sign cert is not trusted
Client (Management Studio) without 'encrypt connection' option set but "Force Encryption" is turned on at SQL Server side using SQL Server Configuration Manager. Client will not verify the self-signed cert and will connect successfully with the connection encrypted.
Why doesn't the client attempt to verify the SQL Server self-signed cert when encryption is enforced on Server Side? Why does the client only verify the self-signed cert when encryption is enforced on the client side?
If cert authentication is not done on client side for server-side encryption, what's the point of using a CA signed cert?
To be more precise: Why doesn't the client (Mgmt Studio) attempt to verify/authenticate the cert (be it self-signed/CA signed) when only server-side encryption is turn on ? Why does the client only authenticate/verify the cert given by the server when client-side encryption ( "encrypt connection" ) is turned on?
I added a signed cert (signed by an internal CA) to be used for server-side encryption. This requires the internal CA cert to be installed (into trusted root CA) on the client machine, but I did not do that. However, the client (mgmt studio) still connects successfully when server-side encryption is turned on.