# Patch for HKUDS/LightRAG at commit 027376b6 (apply inside the lightrag/ checkout: git apply ../patches/lightrag-shared-ssl-context.patch)
# Reuses one SSL context for all OpenAI-compatible clients; without it LightRAG spent ~95% CPU re-creating SSL contexts on Windows.
diff --git a/lightrag/llm/openai.py b/lightrag/llm/openai.py
index a4c06737..806133cd 100644
--- a/lightrag/llm/openai.py
+++ b/lightrag/llm/openai.py
@@ -15,6 +15,7 @@ from openai import (
     APIConnectionError,
     RateLimitError,
     APITimeoutError,
+    DefaultAsyncHttpxClient,
 )
 from tenacity import (
     retry,
@@ -181,9 +182,32 @@ def create_openai_async_client(
         if timeout is not None:
             merged_configs["timeout"] = timeout
 
+        # A new client is created for every LLM/embedding call. Building a fresh
+        # SSL context each time (loading the CA bundle) is CPU-heavy and blocks the
+        # event loop, so reuse one shared context for all clients.
+        if "http_client" not in merged_configs:
+            merged_configs["http_client"] = DefaultAsyncHttpxClient(
+                verify=_shared_ssl_context()
+            )
+
         return AsyncOpenAI(**merged_configs)
 
 
+_SSL_CONTEXT = None
+
+
+def _shared_ssl_context():
+    global _SSL_CONTEXT
+    if _SSL_CONTEXT is None:
+        import ssl
+
+        import certifi
+
+        cafile = os.environ.get("SSL_CERT_FILE") or certifi.where()
+        _SSL_CONTEXT = ssl.create_default_context(cafile=cafile)
+    return _SSL_CONTEXT
+
+
 @retry(
     stop=stop_after_attempt(3),
     wait=wait_exponential(multiplier=1, min=4, max=10),