URLopener with x509?

[bilbo]

I'd like to use https with Python as a client to a private apache
server.

Because it's my server and my client, I thought I could create my own
RSA keys.

URLopener looks promising.  It can take arguments called key_file and
a cert_file.  That sounds like what I need.  The documentation leaves
me wondering what should be in the key_file and cert_file.  Does
anyone have an example of doing this?

Does the client need a private key for an https connection?

The code I've tested so far works with official keys from a
certificate authority, but not with my keys (I'm testing without using
the key_file and cert_file arguments).

I'm hoping I can somehow refer the client to the server's public key
and have the client trust it without asking a certificate authority.