diff --git a/build_macos.py b/build_macos.py
index cfd6588..b806828 100644
--- a/build_macos.py
+++ b/build_macos.py
@@ -226,6 +226,8 @@ def run_pyinstaller():
         "--hidden-import", "webview.platforms.cocoa",
         "--hidden-import", "requests",
         "--collect-all", "mutagen",
+        # certifi ha cacert.pem necessario per SSL/HTTPS
+        "--collect-data", "certifi",
         # Binari bundled (yt-dlp, ffmpeg, ffprobe + dylibs)
         *add_binaries,
         # Entry point
diff --git a/build_windows.py b/build_windows.py
index 73d5dfe..4a3df97 100644
--- a/build_windows.py
+++ b/build_windows.py
@@ -133,6 +133,8 @@ def run_pyinstaller():
         "--collect-all", "pythonnet",
         "--collect-all", "clr_loader",
         "--collect-all", "mutagen",
+        # certifi ha il file dati cacert.pem necessario per SSL/HTTPS
+        "--collect-data", "certifi",
         # collect-data prende anche i file .json/.dll non-Python che
         # collect-all potrebbe saltare (Python.Runtime.runtimeconfig.json
         # in particolare).
diff --git a/core/config.py b/core/config.py
index c0ec941..c3bb250 100644
--- a/core/config.py
+++ b/core/config.py
@@ -5,7 +5,7 @@ import os
 import sys
 from pathlib import Path
 
-VERSION = "v1.8.4"
+VERSION = "v1.8.5"
 
 
 APP_NAME = "MusicTools"
diff --git a/main.py b/main.py
index 5af6b11..1a29c15 100644
--- a/main.py
+++ b/main.py
@@ -4,6 +4,21 @@ import os
 import sys
 from pathlib import Path
 
+# ============================================================
+# Fix SSL CA bundle: quando l'app e' frozen (PyInstaller) i moduli
+# ssl e requests non trovano nessun CA bundle di default -> tutte
+# le chiamate HTTPS falliscono con CERTIFICATE_VERIFY_FAILED.
+# Puntiamo esplicitamente al bundle di certifi (che il build script
+# include via `--collect-data certifi`).
+# ============================================================
+try:
+    import certifi as _certifi
+    _ca_bundle = _certifi.where()
+    os.environ.setdefault("SSL_CERT_FILE", _ca_bundle)
+    os.environ.setdefault("REQUESTS_CA_BUNDLE", _ca_bundle)
+except Exception as _e:
+    print(f"[bootstrap] certifi setup failed: {_e}")
+
 # Windows: forza il caricamento del runtime pythonnet PRIMA di importare
 # webview. Con PyInstaller il lazy-loader fallisce con
 # "Failed to resolve Python.Runtime.Loader.Initialize" perche'
diff --git a/requirements.txt b/requirements.txt
index 2edd217..b6c1ff1 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,6 @@
 pywebview>=5.0
 requests>=2.31.0
+certifi>=2024.0.0
 yt-dlp>=2024.0.0
 mutagen>=1.47.0
 pyobjc-core>=10.0 ; sys_platform == "darwin"