diff --git a/astrbot/core/utils/llm_metadata.py b/astrbot/core/utils/llm_metadata.py
index 915d8d8f9..fc0890f4b 100644
--- a/astrbot/core/utils/llm_metadata.py
+++ b/astrbot/core/utils/llm_metadata.py
@@ -1,6 +1,8 @@
+import ssl
 from typing import Literal, TypedDict
 
 import aiohttp
+import certifi
 
 from astrbot.core import logger
 
@@ -32,7 +34,11 @@ LLM_METADATAS: dict[str, LLMMetadata] = {}
 async def update_llm_metadata() -> None:
     url = "https://models.dev/api.json"
     try:
-        async with aiohttp.ClientSession() as session:
+        ssl_context = ssl.create_default_context(cafile=certifi.where())
+        connector = aiohttp.TCPConnector(ssl=ssl_context)
+        async with aiohttp.ClientSession(
+            trust_env=True, connector=connector
+        ) as session:
             async with session.get(url) as response:
                 data = await response.json()
                 global LLM_METADATAS
diff --git a/astrbot/core/utils/t2i/network_strategy.py b/astrbot/core/utils/t2i/network_strategy.py
index 2abb22917..9eff5746b 100644
--- a/astrbot/core/utils/t2i/network_strategy.py
+++ b/astrbot/core/utils/t2i/network_strategy.py
@@ -39,7 +39,12 @@ class NetworkRenderStrategy(RenderStrategy):
     async def get_official_endpoints(self) -> None:
         """获取官方的 t2i 端点列表。"""
         try:
-            async with aiohttp.ClientSession() as session:
+            ssl_context = ssl.create_default_context(cafile=certifi.where())
+            connector = aiohttp.TCPConnector(ssl=ssl_context)
+            async with aiohttp.ClientSession(
+                trust_env=True,
+                connector=connector,
+            ) as session:
                 async with session.get(
                     "https://api.soulter.top/astrbot/t2i-endpoints",
                 ) as resp:
diff --git a/main.py b/main.py
index 68e03dc9a..26355f7a0 100644
--- a/main.py
+++ b/main.py
@@ -50,6 +50,16 @@ def check_env() -> None:
     os.makedirs(get_astrbot_temp_path(), exist_ok=True)
     os.makedirs(site_packages_path, exist_ok=True)
 
+    try:
+        import certifi
+
+        certifi_cafile = certifi.where()
+        if certifi_cafile and os.path.exists(certifi_cafile):
+            os.environ.setdefault("SSL_CERT_FILE", certifi_cafile)
+            os.environ.setdefault("REQUESTS_CA_BUNDLE", certifi_cafile)
+    except Exception as e:
+        logger.warning(f"Failed to configure certifi CA bundle: {e}")
+
     # 针对问题 #181 的临时解决方案
     mimetypes.add_type("text/javascript", ".js")
     mimetypes.add_type("text/javascript", ".mjs")