Remote Access SSL VPN on the ASA, which uses the AnyConnect client, has something called the client profile.
When you use it (it's optional for the admin to define one), the profile governs multiple settings about how the client connects. Every time the client connects, the ASA checks to ensure the local copy of the profile is current (it uses a hash of the file to compare the one on the ASA with the one on the client). Thus all the settings are ensured to be correct.
The local policy is the other piece governing AnyConnect client behavior. It is not deployed from the ASA but is stored locally on the client. We typically deploy it using something like SCCM. Unfortunately, it is subject to end user modification unless you lock down the remote workstations to prevent it from happening.
The local policy is where the "Strict Certificate Trust" setting is located. You can create and send out a local policy using the Anyconnect profile editor software available on the AnyConnect downloads page.
Both the profile and the local policy are small xml files that are pretty much human readable. They can also be manually edited. for instance, the following output and associated GUI settings are representations of the same thing:
<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectLocalPolicy xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectLocalPolicy.xsd" acversion="3.0.0592">
<FipsMode>true</FipsMode>
<BypassDownloader>true</BypassDownloader>
<RestrictWebLaunch>true</RestrictWebLaunch>
<StrictCertificateTrust>true</StrictCertificateTrust>
<EnableCRLCheck>false</EnableCRLCheck>
<RestrictPreferenceCaching>false</RestrictPreferenceCaching>
<ExcludePemFileCertStore>false</ExcludePemFileCertStore>
<ExcludeMacNativeCertStore>false</ExcludeMacNativeCertStore>
<ExcludeFirefoxNSSCertStore>false</ExcludeFirefoxNSSCertStore>
<UpdatePolicy>
<AllowSoftwareUpdatesFromAnyServer>true</AllowSoftwareUpdatesFromAnyServer>
<AllowVPNProfileUpdatesFromAnyServer>true</AllowVPNProfileUpdatesFromAnyServer>
<AllowServiceProfileUpdatesFromAnyServer>true</AllowServiceProfileUpdatesFromAnyServer>
<AllowISEProfileUpdatesFromAnyServer>true</AllowISEProfileUpdatesFromAnyServer>
<AllowComplianceModuleUpdatesFromAnyServer>true</AllowComplianceModuleUpdatesFromAnyServer>
</UpdatePolicy>
</AnyConnectLocalPolicy>
You can edit the policy and deploy it as described here:
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect44/administration/guide/b_AnyConnect_Administrator_Guide_4-4/anyconnect-profile-editor.html#ID-1430-0000032f
