Android repo SSL CERTIFICATE_VERIFY_FAILED

I'm trying to follow Google's documentation to build my own version of Android, but it fails on the "repo init" state (step 2 of section 2): https://source.android.com/source/downloading.html

When I run 'repo init -u https://android.googlesource.com/platform/manifest'

it answers with

fatal: Cannot get https://gerrit.googlesource.com/git-repo/clone.bundle
fatal: error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)

I don't really know what to try, besides making sure I have all the proper tools ( I do, a brand new Macbook Pro w/ El Capitan, Python 2.7, GPG installed, all of that.) What could I have forgotten to do? Is there anything I can do to disable the SSL check, change the certificate, or anything like that?

Solution

Most likely this is happening because you're using macports python.

$ port select --list python
Available versions for python:
    none
    python26-apple
    python27 (active)
    python27-apple
$ sudo port select --set python python27-apple
Selecting 'python27-apple' for 'python' succeeded. 'python27-apple' is now active.

The underlying problem is that OS X stores CA root certificates in the Keychain ring, but python.org python does not query the Keychain ring. See http://bugs.python.org/issue17128