question on "--ssl-ca" flag during ssl connection

[sridhar subramanya]

I've a mysql server running on redhat8 and enabled it for TLS/SSL one way authentication.

my question is about the significance of using "--ssl-ca" to validate the server certificate , given that there are instances where mysql client/shell (probably version 8 or older) getting connected successfully to the server without providing --ssl-ca as a part of connection.

I thought it was an expected behavior. in the above case i assume connections are still secure its just that, server certificate were not validated from the client side.

i assume its the responsibility of the connecting client or application to validate/verify that the certificate from their end .

if my assumption was wrong , Does server can act as a gate keeper or does have any setting on the server side which could dictate incoming client connections to validate its certificate and restrict the connection if its not.

request your valuable input on the matter.

Thanks,
Sri