Now, if I generate a self signed, it does say it is valid

Yeah it is a whole thing to setup certs that aren’t self signed on non-persistent VDA. If you google around there are blog posts on how to do it