def choose_connect_args(metadata, config):
    """
    Choose the SSL mode and optional root cert for the connection.

    """
    if not config.require_ssl and not config.verify_ssl:
        return dict(
            sslmode="prefer",
        )

    if config.require_ssl and not config.verify_ssl:
        return dict(
            sslmode="require",
        )

    if not config.ssl_cert_path:
        raise Exception("SSL certificate path (`ssl_cert_path`) must be configured for verification")

    return dict(
        sslmode="verify-full",
        sslrootcert=config.ssl_cert_path,
    )