diff --git a/pyproject.toml b/pyproject.toml
index c0058cb..896f2c0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -21,6 +21,7 @@ classifiers = [
 
 dependencies = [
     "agentrun-sdk[core]>=0.0.37",
+    "certifi>=2024.0.0",
     "oss2>=2.19.1",
     "pyyaml>=6.0",
     "questionary>=2.0",
diff --git a/src/agentrun_cli/main.py b/src/agentrun_cli/main.py
index de48631..102c8d9 100644
--- a/src/agentrun_cli/main.py
+++ b/src/agentrun_cli/main.py
@@ -13,9 +13,12 @@
 import logging
 import os
 
+import certifi
 import click
 
 os.environ.setdefault("DISABLE_BREAKING_CHANGES_WARNING", "1")
+if "SSL_CERT_FILE" not in os.environ:
+    os.environ["SSL_CERT_FILE"] = certifi.where()
 
 from agentrun_cli import __version__
 from agentrun_cli.commands.config_cmd import config_group
diff --git a/tests/unit/test_main.py b/tests/unit/test_main.py
index 5cbcf94..02c3c71 100644
--- a/tests/unit/test_main.py
+++ b/tests/unit/test_main.py
@@ -1,13 +1,34 @@
 """Unit tests for agentrun_cli.main — main() entry point."""
 
-from unittest.mock import patch
+import importlib
+from unittest.mock import Mock, patch
 
-from agentrun_cli.main import main
+import agentrun_cli.main as main_module
 
 
 class TestMainEntryPoint:
     def test_main_function_directly(self):
         """Call main() directly — it delegates to cli()."""
         with patch("agentrun_cli.main.cli") as mock_cli:
-            main()
+            main_module.main()
             mock_cli.assert_called_once()
+
+    def test_default_ssl_cert_file_uses_certifi(self, monkeypatch):
+        """Default SSL_CERT_FILE to certifi when the user has not set it."""
+        monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+        monkeypatch.setattr(main_module.certifi, "where", lambda: "/tmp/cacert.pem")
+
+        importlib.reload(main_module)
+
+        assert main_module.os.environ["SSL_CERT_FILE"] == "/tmp/cacert.pem"
+
+    def test_preserves_user_ssl_cert_file(self, monkeypatch):
+        """Do not override an explicit user SSL_CERT_FILE."""
+        monkeypatch.setenv("SSL_CERT_FILE", "/custom/ca.pem")
+        mock_where = Mock(return_value="/tmp/cacert.pem")
+        monkeypatch.setattr(main_module.certifi, "where", mock_where)
+
+        importlib.reload(main_module)
+
+        assert main_module.os.environ["SSL_CERT_FILE"] == "/custom/ca.pem"
+        mock_where.assert_not_called()