diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py
--- a/Lib/urllib/request.py
+++ b/Lib/urllib/request.py
@@ -136,7 +136,7 @@
 
 _opener = None
 def urlopen(url, data=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
-            *, cafile=None, capath=None, cadefault=False):
+            *, cafile=None, capath=None, cadefault=False, check_hostname=None):
     global _opener
     if cafile or capath or cadefault:
         if not _have_ssl:
@@ -149,9 +149,8 @@
                 context.load_verify_locations(cafile, capath)
             else:
                 context.set_default_verify_paths()
-            check_hostname = True
-        else:
-            check_hostname = False
+            if check_hostname is None:
+                check_hostname = True
         https_handler = HTTPSHandler(context=context, check_hostname=check_hostname)
         opener = build_opener(https_handler)
     elif _opener is None: