Which SSL settings win in DataGrip when the SSH/SSL tab and Advanced JDBC properties disagree?

I am configuring a PostgreSQL data source in DataGrip and want strict TLS certificate validation, including hostname checking. The data source dialog offers an SSH/SSL tab with fields for a CA certificate and a server-certificate verification toggle, while the Advanced tab lets me set driver-level properties such as sslmode and sslrootcert directly.

My understanding is that the GUI fields are translated into JDBC connection properties when the session opens, but I cannot find documentation describing what happens when both layers are populated with conflicting values. For example, if the GUI verification toggle is off but sslmode=verify-full is set in Advanced (or the reverse), the effective behavior is unclear, and it may differ between the bundled PostgreSQL driver and MySQL Connector/J, or between driver versions that DataGrip downloads independently of the IDE release.

A related concern is that a connection can report SSL as enabled while only encrypting, skipping chain and hostname validation entirely, so I do not want to rely on the checkbox state as evidence of identity checking.

Is there a documented precedence rule between the SSH/SSL tab fields and Advanced driver properties? Does DataGrip expose the final JDBC URL or merged property set sent to the driver so I can verify which values actually applied? And is the answer stable across driver versions, or must it be re-checked after each driver update?