pkg/55212: python cannot verify SSL certificates

[dbaron%definitely.at@localhost]

>Number:         55212
>Category:       pkg
>Synopsis:       python cannot verify SSL certificates
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 27 07:50:00 +0000 2020
>Originator:     Dieter Baron
>Release:        NetBSD 8.0
>Organization:
>Environment:
NetBSD definitely.at 8.0_BETA NetBSD 8.0_BETA (GENERIC.201711211410Z) amd64

>Description:
Python 3.7 installed via pkgsrc fails to verify certificates that are valid (as seen by all major browsers):

urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>

>How-To-Repeat:
Run the following python 3 script:

import urllib.request

with urllib.request.urlopen("https://google.com/";) as request:
        data = request.read()

>Fix:
I suspect Python and NetBSD/pkgsrc disagree over where the root certificates are stored.