I resolved this by using this
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt do-release-upgrade

I understand this is a temporary solution but i did review this since it got the job done for me.

Following the conversation thread at Ubuntu forum, I understand the following steps would have been a permanent fix -- so just sharing.

The problem is the used ca:

$ python3 -c 'import ssl; print(ssl.get_default_verify_paths().openssl_cafile)'
/usr/lib/ssl/cert.pem

But:

$ ll /usr/lib/ssl/cert.pem
ls: cannot access '/usr/lib/ssl/cert.pem': No such file or directory

You can fix it by linking the global ca-certificates to the file Python uses:

ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem

After that running do-release-upgrade works just fine.