From f5917ac6fc83103941ebf578da6371b897cb6f91 Mon Sep 17 00:00:00 2001
From: Kyle Isom <kyle@imap.cc>
Date: Tue, 18 Nov 2025 20:55:41 -0800
Subject: [PATCH] verify/verify.go: fix nil point deref

---
 certlib/verify/verify.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/certlib/verify/verify.go b/certlib/verify/verify.go
index 39cab89..cb6a285 100644
--- a/certlib/verify/verify.go
+++ b/certlib/verify/verify.go
@@ -48,7 +48,9 @@ func prepareVerification(w io.Writer, target string, opts *Opts) (*verifyResult,
 			Config:             lib.StrictBaselineTLSConfig(),
 			ForceIntermediates: false,
 		}
+	}
 
+	if opts.Config.RootCAs == nil {
 		roots, err = x509.SystemCertPool()
 		if err != nil {
 			return nil, fmt.Errorf("couldn't load system cert pool: %w", err)