so I copied the pem file into a volume:

/Volumes/catalog/schema/volume/aws-global-bundle.pem

and to the workspace:

/Workspace/Shared/global-bundle.pem

data sec mode: None cannot read this file and so throws the error:

Failed to find serverSslCert file. serverSslCert=/Volumes/catalog/schema/volume.....

this is expected since UC is not enabled basically in this mode. 
I get the same thing if I try to reference it at the workspace location: /Workspace/Shared/global-bundle.pem.

But really I want it to work with data security mode User isolation. the result is the same error as before using both locations:

SparkConnectGrpcException: (java.sql.SQLTransientConnectionException) Could not connect to address=(host=HOSTm)(port=PORT)(type=master) : (conn=715518) Connections using insecure transport are prohibited while --require_secure_transport=ON.​

 What is interesting to me is its either not getting to the part where it looks for this pem file, OR its getting passed it but erroring out afterwards. To test this I tried a bogus file location in the volume

/Volumes/catalog/schema/volume/bad.pem

Same error. Which makes me thing its erroring before its even going to look for that file....