urllib docs for URLOpener say: 
 
Additional keyword parameters, collected in x509, are 
used for authentication with the https: scheme. The 
keywords key_file and cert_file are supported; both are 
needed to actually retrieve a resource at an https: URL. 
 
 
They're not needed, and the certificate is never 
checked, because _ssl.c doesn't check it (which is 
documented in the socket.ssl docs). 
 
A doc patch is attached.