On linux, or in a docker container the following command will solve the problem:
curl https://raw.githubusercontent.com/rubygems/rubygems/master/lib/rubygems/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem > $(ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE')
The above command will fetch the CA cert that rubygems expects when connecting to its website and install it in the location that ruby expects the cert to live.
Thanks to Gabe Evans helpful blog post, for detailing a smart way of solving the problem in one line of code.
I modified Gabe's solution to use the CA cert specified on the rubygems website. Further discussion of why this problem arose can be found there.
The benefit of this solution is that it uses https to fetch the updated cert for rubygems. Since it fetches this cert from github it can work even with a SHA1 cert. It is also handy because it uses ruby, by pulling in the openssl library to place the cert where it needs to go.