Using a SSL-cert from a trusted CA offline to comunicate with SQL Server
A trusted CA does not require online connectivity to validate the certificate. The certificate is signed with a chain of signatures that is rooted in a private key for which the corresponding public key is already present in your system (this is what 'trusted CA' means, after all). You may be thinking at the certificate revocation list, which must be periodically refreshed online, but the system will work with even if the CRL cannot be refreshed.

Within an intranet there are options to use a corporate CA, but it does require a domain and PKI deployed.

Self-signed certificates with SQL Server provide only encryption, no server authentication. See Using Encryption Without Validation. There are no dialogs to popup for the clients, your connection attempt succeed or fails depending on a number of factors (read the article linked).