Self-signed certificates are vulnerable to man-in-the-middle attacks, but this is still far better than plain text logins.
SQL Server 2000 , 2005, or 2008 should have a valid certificate signed by a certificate authority for the SSL encryption.