diff --git a/mercurial/url.py b/mercurial/url.py
--- a/mercurial/url.py
+++ b/mercurial/url.py
@@ -145,6 +145,8 @@ class passwordmgr(urllib2.HTTPPasswordMg
                 continue
             group, setting = key.split('.', 1)
             gdict = config.setdefault(group, dict())
+            if setting in ('cert', 'key'):
+                val = util.expandpath(val)
             gdict[setting] = val
 
         # Find the best match