# XO0902: `tls.Verify.None` checks no certificate

Reported by `xo vet` as a warning, once per use. A `tls.client` with `verify: tls.Verify.None` encrypts the connection but accepts any certificate, so an active attacker can stand in for the server (libpq's `sslmode=require`). `tls.Verify.ChainOnly` checks the chain against the roots without the host name (`sslmode=verify-ca`), and `roots: tls.roots(pem)` trusts a private CA while keeping the full check.

## Example

```xo
tls.client(c, host, verify: tls.Verify.None)
```

## Fix

```xo
tls.client(c, host, roots: Some(tls.roots(ca_pem)?))
```

Run `xo explain XO0902` for this text in a terminal, or see
[section 10.6 of the specification](../../spec/core/#106-diagnostic-codes).