Use `secure: true` to access https targets without cert