diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index e38dbcfb5..22fb82943 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -69,6 +69,9 @@ const envSchema = z
     SMTP_PASSWORD: zpStr(z.string().optional()),
     SMTP_FROM_ADDRESS: zpStr(z.string().optional()),
     SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")),
+    SMTP_CUSTOM_CA_CERT: zpStr(
+      z.string().optional().describe("PEM-encoded custom CA certificate(s) for the SMTP server")
+    ),
     COOKIE_SECRET_SIGN_KEY: z
       .string()
       .min(32)
@@ -298,6 +301,17 @@ export const initEnvConfig = (logger?: CustomLogger) => {
 };
 
 export const formatSmtpConfig = () => {
+  const tlsOptions: {
+    rejectUnauthorized: boolean;
+    ca?: string | string[];
+  } = {
+    rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
+  };
+
+  if (envCfg.SMTP_CUSTOM_CA_CERT) {
+    tlsOptions.ca = envCfg.SMTP_CUSTOM_CA_CERT;
+  }
+
   return {
     host: envCfg.SMTP_HOST,
     port: envCfg.SMTP_PORT,
@@ -309,8 +323,6 @@ export const formatSmtpConfig = () => {
     from: `"${envCfg.SMTP_FROM_NAME}" <${envCfg.SMTP_FROM_ADDRESS}>`,
     ignoreTLS: envCfg.SMTP_IGNORE_TLS,
     requireTLS: envCfg.SMTP_REQUIRE_TLS,
-    tls: {
-      rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
-    }
+    tls: tlsOptions
   };
 };
diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx
index b63c58d3a..199111e84 100644
--- a/docs/self-hosting/configuration/envars.mdx
+++ b/docs/self-hosting/configuration/envars.mdx
@@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings
 <ParamField query="HOST" type="string" default="localhost" optional>
   Specifies the network interface Infisical will bind to when accepting incoming connections.
 
-  By default, Infisical binds to `localhost`, which restricts access to connections from the same machine. 
+  By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
 
   To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
 
@@ -95,7 +95,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
 </ParamField>
 
 <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
-  Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. 
+  Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
   Use the command below to encode your certificate:
   `echo "<certificate>" | base64`
 </ParamField>
@@ -222,7 +222,7 @@ SMTP_FROM_NAME=Infisical
       This will be used to verify the email you are sending from.
       ![Create SES identity](../../images/self-hosting/configuration/email/ses-create-identity.png)
       <Info>
-        If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies. 
+        If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
       </Info>
     </Step>
     <Step title="Create an account and configure AWS SES">
@@ -388,9 +388,9 @@ SMTP_FROM_NAME=Infisical
   </Info>
 </Accordion>
 
-<Accordion title="SMTP2Go"> 
+<Accordion title="SMTP2Go">
 1. Create an account and configure [SMTP2Go](https://www.smtp2go.com/) to send emails.
-2. Turn on SMTP authentication  
+2. Turn on SMTP authentication
 ```
 SMTP_HOST=mail.smtp2go.com
 SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
@@ -401,7 +401,7 @@ SMTP_FROM_NAME=Infisical
 ```
 {" "}
 
-<Note> 
+<Note>
 Optional (for TLS/SSL):
 
 TLS: Available on the same ports (2525, 80, 25, 8025, or 587)
@@ -410,6 +410,19 @@ SSL: Available on ports 465, 8465, and 443
 </Note>
 </Accordion>
 
+### Custom CA Certificate for Email Service TLS
+
+If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables:
+
+```
+SMTP_PORT=465 # Or your SMTPS/STARTTLS port
+SMTP_CUSTOM_CA_CERT='[CERTIFICATE PEM]'
+
+# Always keep these as true for custom CA
+SMTP_REQUIRE_TLS=true
+SMTP_TLS_REJECT_UNAUTHORIZED=true
+```
+
 ## Authentication
 
 By default, users can only login via email/password based login method.