MSSQL port 1433 can accept both SSL and non-SSL connections. But how to be ensure? You set host, ca file and encryption options and you see in Wireshark plain text instead of encrypted TLS. I just removed ca file option and it working now. Bug? May be.
[ms_sql_server] host = test-mssql1.cxb4fdshfdhd9.us-east-1.rds.amazonaws.com encryption = require
Start capturing in Wireshark again, reconnect to server and now you can see TLS packets
Fortune cookie: "You pronounce sentence upon me with greater fear than I receive it." [Giordano Bruno to his inquisitors]