note xmlrpclib doesn't verify certs (yet)
diff --git a/Doc/library/xmlrpclib.rst b/Doc/library/xmlrpclib.rst
index 0e9ff4b..766a796 100644
--- a/Doc/library/xmlrpclib.rst
+++ b/Doc/library/xmlrpclib.rst
@@ -34,6 +34,11 @@
constructed data. If you need to parse untrusted or unauthenticated data see
:ref:`xml-vulnerabilities`.
+.. warning::
+
+ In the case of https URIS, :mod:`xmlrpclib` does not do any verification of
+ the server's certificate.
+
.. class:: ServerProxy(uri[, transport[, encoding[, verbose[, allow_none[, use_datetime]]]]])