When attempting to load or refresh the plugins list in Picard 3.0.0a3 on macOS, the following error is displayed:

[16:04:25] Loaded 0 plugins
[16:04:29] Refreshing plugin registry, list, and checking for updates…
[16:04:37] Error refreshing: Failed to fetch registry from https://picard.musicbrainz.org/registry/plugins.toml: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>

Notes

• Based on the full debug log (below), it appears Picard is trying to load a file from Github, then falls back to the MusicBrainz website. Both fail with the SSL error.
• I'm able to access the GitHub URL just fine through browser or curl (in other words, SSL is generally working on my system).
• The plugins.toml file on the MusicBrainz site is 404.

Debug log

D: 16:04:25,419 picard/util/readthedocs._get_language:216: Matched documentation language set to 'en'
D: 16:04:25,420 picard/util/readthedocs._get_version:237: Matched documentation version set to 'latest'
D: 16:04:25,538 picard/ui/options/dialog._init_:283: OptionsDialog init: Trying to restore page 'plugins'
D: 16:04:25,539 picard/ui/options/dialog.add_pages:201: add_pages: Found matching page 'plugins', setting as default_item
D: 16:04:25,693 picard/ui/options/dialog.refresh_plugin_pages:532: refresh_plugin_pages: Starting refresh
D: 16:04:25,694 picard/ui/options/dialog.add_pages:201: add_pages: Found matching page 'plugins', setting as default_item
D: 16:04:25,695 picard/ui/options/dialog.switch_page:523: switch_page: Saving page 'plugins' to options_last_active_page
D: 16:04:25,695 picard/ui/options/dialog.refresh_plugin_pages:631: refresh_plugin_pages: Refresh complete
D: 16:04:29,634 picard/plugin3/registry.fetch_registry:192: Fetching registry from https://raw.githubusercontent.com/metabrainz/picard-plugins-registry/refs/heads/main/plugins.toml (URL 1/2)
W: 16:04:29,743 picard/plugin3/registry.fetch_registry:268: Registry fetch failed (attempt 1/3): <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
I: 16:04:29,743 picard/plugin3/registry.fetch_registry:274: Retrying in 1 seconds...
W: 16:04:30,792 picard/plugin3/registry.fetch_registry:268: Registry fetch failed (attempt 2/3): <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
I: 16:04:30,792 picard/plugin3/registry.fetch_registry:274: Retrying in 2 seconds...
W: 16:04:32,889 picard/plugin3/registry.fetch_registry:285: Failed to fetch registry from https://raw.githubusercontent.com/metabrainz/picard-plugins-registry/refs/heads/main/plugins.toml: Failed to fetch registry from https://raw.githubusercontent.com/metabrainz/picard-plugins-registry/refs/heads/main/plugins.toml: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
D: 16:04:32,889 picard/plugin3/registry.fetch_registry:192: Fetching registry from https://picard.musicbrainz.org/registry/plugins.toml (URL 2/2)
W: 16:04:33,264 picard/plugin3/registry.fetch_registry:268: Registry fetch failed (attempt 1/3): <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
I: 16:04:33,265 picard/plugin3/registry.fetch_registry:274: Retrying in 1 seconds...
W: 16:04:34,646 picard/plugin3/registry.fetch_registry:268: Registry fetch failed (attempt 2/3): <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
I: 16:04:34,647 picard/plugin3/registry.fetch_registry:274: Retrying in 2 seconds...
W: 16:04:37,052 picard/plugin3/registry.fetch_registry:285: Failed to fetch registry from https://picard.musicbrainz.org/registry/plugins.toml: Failed to fetch registry from https://picard.musicbrainz.org/registry/plugins.toml: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
E: 16:04:37,053 picard/ui/options/plugins._refresh_all:254: Failed to refresh all: Failed to fetch registry from https://picard.musicbrainz.org/registry/plugins.toml: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>
Traceback (most recent call last):
  File "urllib/request.py", line 1321, in do_open
  File "http/client.py", line 1358, in request
  File "http/client.py", line 1404, in _send_request
  File "http/client.py", line 1353, in endheaders
  File "http/client.py", line 1113, in _send_output
  File "http/client.py", line 1057, in send
  File "http/client.py", line 1499, in connect
  File "ssl.py", line 455, in wrap_socket
  File "ssl.py", line 1076, in _create
  File "ssl.py", line 1372, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "picard/plugin3/registry.py", line 229, in fetch_registry
  File "urllib/request.py", line 187, in urlopen
  File "urllib/request.py", line 487, in open
  File "urllib/request.py", line 504, in _open
  File "urllib/request.py", line 464, in _call_chain
  File "urllib/request.py", line 1369, in https_open
  File "urllib/request.py", line 1324, in do_open
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "picard/ui/options/plugins.py", line 228, in _refresh_all
  File "picard/plugin3/manager/_init_.py", line 298, in refresh_registry_and_caches
  File "picard/plugin3/registry.py", line 292, in fetch_registry
  File "picard/plugin3/registry.py", line 277, in fetch_registry
picard.plugin3.registry.RegistryFetchError: Failed to fetch registry from https://picard.musicbrainz.org/registry/plugins.toml: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)>