pandevice.errors.PanURLError: URLError: reason: [SSL: CERTIFICATE_VERIFY_FAILED]

Getting below since 2 days, my Panorama is 7.1.9 and firewall 7.1.7:

python pandevice.pano.commit_all.py
Traceback (most recent call last):
  File "pandevice.pano.commit_all.py", line 18, in <module>
    id=pano.commit_all(cmd="<commit-all><shared-policy><include-template>yes</include-template><device-group><entry name='MR-DC1-PROD'/></device-group></shared-policy></commit-all>")
  File "/usr/lib/python2.7/site-packages/pandevice/panorama.py", line 186, in commit_all
    cmd=cmd)
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 2293, in _commit
    commit_response = self.xapi.commit(cmd=cmd,
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 1646, in xapi
    self._xapi_private = self.generate_xapi()
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 1694, in generate_xapi
    kwargs = {'api_key': self.api_key,
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 1640, in api_key
    self._api_key = self._retrieve_api_key()
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 1780, in _retrieve_api_key
    xapi.keygen(retry_on_peer=False)
  File "/usr/lib/python2.7/site-packages/pandevice/base.py", line 1571, in method
    raise the_exception
pandevice.errors.PanURLError: URLError: reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)

Here is my simple script:

$ cat pandevice.pano.commit_all.py 
#!/usr/bin/python
#.....imports omitted
import time
pano = panorama.Panorama("10.34.2.249", "admin", "password")
id=pano.commit_all(cmd="<commit-all><shared-policy><include-template>yes</include-template><device-group><entry name='MR-DC1-PROD'/></device-group></shared-policy></commit-all>")
time.sleep(300)
cmd = 'show jobs id "' + id + '"'
print pano.op(cmd, xml=True)

Start in pandevice/base.py around _retrieve_api_key, generate_xapi, and xapi, then trace the failing keygen call from panorama.py commit_all. Reproduce the certificate verification error with the supplied script; done means the same commit_all path has a supported resolution for the SSL failure.