SSL: CERTIFICATE_VERIFY_FAILED error

[ndepal]

I'm trying to install some ROS packages on a Nvidia Tegra X1 running Ubuntu 16.04.
I have installed ROS with sudo apt-get install ros-kinetic-ros-base and rosinstall_generator with sudo apt-get install python-rosinstall-generator.

When I try to use rosinstall_generator I get an SSL error:

$ rosinstall_generator --rosdistro kinetic mavlink
Traceback (most recent call last):
  File "/usr/bin/rosinstall_generator", line 141, in <module>
    rc = main()
  File "/usr/bin/rosinstall_generator", line 129, in main
    upstream_version_tag=args.upstream, upstream_source_version=args.upstream_development)
  File "/usr/lib/python2.7/dist-packages/rosinstall_generator/generator.py", line 249, in generate_rosinstall
    wet_package_names, unreleased_repo_names = _get_packages_for_repos(distro_name, repo_names)
  File "/usr/lib/python2.7/dist-packages/rosinstall_generator/generator.py", line 93, in _get_packages_for_repos
    wet_distro = get_wet_distro(distro_name)
  File "/usr/lib/python2.7/dist-packages/rosinstall_generator/generator.py", line 215, in get_wet_distro
    _wet_distro = _get_wet_distro(distro_name)
  File "/usr/lib/python2.7/dist-packages/rosinstall_generator/distro.py", line 45, in get_distro
    index = get_index(get_index_url())
  File "/usr/lib/python2.7/dist-packages/rosdistro/__init__.py", line 101, in get_index
    yaml_str = load_url(url)
  File "/usr/lib/python2.7/dist-packages/rosdistro/loader.py", line 59, in load_url
    raise URLError(str(e) + ' (%s)' % url)
urllib2.URLError: <urlopen error <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)> (https://raw.githubusercontent.com/ros/rosdistro/master/index.yaml)>

Is this a known issue? Does anybody have a fix?

[dirk-thomas]

If you open the same URL in your browser what does the certificate say for you?

[tfoote]

Do you have ca-certificates installed? And have you rehashed the ssl certificate database? There's a known issue on nvidia platforms: ros/rosdistro#12894 (comment)

Browsers often have their own ca-certificates and proxies you can check pure python access using:
python -c "from urllib2 import urlopen; print urlopen('https://raw.githubusercontent.com/ros/rosdistro/master/index.yaml').read()"

[ndepal]

@dirk-thomas I ssh into the Tegra, so I can't check the browser from there. But curling the URL works.

@tfoote sudo c_rehash /etc/ssl/certs as per your linked comment fixed it.

Thanks!

[imbesat-rizvi]

For me rehash also didn't work. Had to set up SSL_CERT_FILE bash environment variable as suggested in an answer at this link:
export SSL_CERT_FILE=/usr/lib/ssl/certs/ca-certificates.crt
The same can be made a part of bashrc file for future use. No more SSL: CERTIFICATE_VERIFY_FAILED error for me after this.