Question: I want to insert new `<li>` element to my function output.

```
function gallery_nav() {
    $i = 0;
    foreach ($myArray as $key ) {
        $i++;
        echo '<li><a href="#">'. $i .'</a></li>';
    }
}

```

It printing this html

```
<li>1</li>
<li>2</li>
<li>3</li>
<li>4</li>
<li>5</li>
<li>6</li>
<li>7</li>

```

Can i insert custom `<li>` element into this array? Like this:

```
<li>1</li>
<li>2</li>
<li class="custom">3</li>
<li>4</li>
<li>5</li>
<li class="custom">6</li>
<li>7</li>
<li>8</li>
<li>9</li>

```

Answer: 
Old question but chiming in for those who land here. No expert. Please consult with your local security gurus and what not.

Axios is an http(s) client and http clients usually participate in TLS anonymously. In other words, the server accepts their connection without identifying who is trying to connect. This is different then say, Mutual TLS where both the server and client verify each other before completing the handshake.

The internet is a scary place and we want to protect our clients from connecting to spoofed public endpoints. We do this by ensuring our clients identify the server before sending any private data.

```
// DO NOT DO THIS IF SHARING PRIVATE DATA WITH SERVICE
const httpsAgent = new https.Agent({ rejectUnauthorized: false });

```

This is often posted (and more egregiously upvoted) as the answer on StackOverflow regarding https client connection failures in any language. And what's worse is that it usually works, unblocks the dev and they move on their merry way. However, while they certainly get in the door, whose door is it? Since they opted out of verifying the server's identity, their poor client has no way of knowing if the connection they just made to the company's intranet has bad actors listening on the line.

If the service has a public SSL cert, the `https.Agent` usually does not need to be configured further because your operating system provides a common set of publicly trusted CA certs. This is usually the same set of CA certs your browser is configured to use and is why a default axios client can hit <https://google.com> with little fuss.

If the service has a private SSL cert (self signed for testing purposes or one signed by your company's private CA to protect their internal secrets), the https agent must be configured to trust the private CA used to sign the server cert:

```
const httpsAgent = new https.Agent({ ca: MY_CA_BUNDLE });

```

where `MY_CA_BUNDLE` is an array of CA certs with both the server cert for the endpoint you want to hit and that cert's complete cert chain in `.pem` format. You must include all certs in the chain up to the trust root.

---

### Where are these options documented?

> 
> HTTPS is the HTTP protocol over TLS/SSL. In Node.js this is implemented as a separate module.
> 
> 
> 

Therefore options passed to the `https.Agent` are a merge of the options passed to [`tls.connect()`](https://nodejs.org/api/tls.html#tls_tls_connect_options_callback) and [`tls.createSecureContext()`](https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options).
This worked for me:

```js
import axios from 'axios'
import https from 'https'

const headers = {};

const httpsAgent = new https.Agent({
  ca: fs.readFileSync('./certs/cert.pem'),
  cert: fs.readFileSync('./certs/cert.pem'),
})

const data = await axios.get(url, { httpsAgent, headers })

```