Which checks are required to authenticate the intended TLS service?

Which checks are required to authenticate the intended TLS service?

1. Validate the certificate path against trusted roots and match the requested hostname.
2. Accept any signed certificate as long as the bytes are encrypted.
3. Match only the connected IP address and skip certificate validation.