diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx
index e35dc2503..8da732d6d 100644
--- a/docs/self-hosting/configuration/envars.mdx
+++ b/docs/self-hosting/configuration/envars.mdx
@@ -96,8 +96,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
 
 <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
   Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
-  Use the command below to encode your certificate:
-  `echo "<certificate>" | base64`
+  Use the following command to encode your certificate: `echo "<certificate>" | base64`
 </ParamField>
 
 <ParamField query="DB_READ_REPLICAS" type="string" default="" optional>
@@ -111,10 +110,9 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]
     </ParamField>
     <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
       Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64.
-	    Use the command below to encode your certificate:
-      `echo "<certificate>" | base64`
+	    Use the following command to encode your certificate: `echo "<certificate>" | base64`
 
-    		If not provided it will use master SSL certificate.
+      If not provided it will use master SSL certificate.
     </ParamField>
 
   </Expandable>
@@ -169,6 +167,16 @@ Without email configuration, Infisical's core functions like sign-up/login and s
 <ParamField query="SMTP_TLS_REJECT_UNAUTHORIZED" type="bool" default="true" optional>
   If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
 </ParamField>
+
+<ParamField query="SMTP_CUSTOM_CA_CERT" type="string" default="none" optional>
+    If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.
+
+    This variable **must be a base64 encoded PEM certificate**. Use the following command to encode your certificate: `echo "<certificate>" | base64`
+
+    Infisical highly encourages the following variables be used alongside this one for maximum security:
+    - `SMTP_REQUIRE_TLS=true`
+    - `SMTP_TLS_REJECT_UNAUTHORIZED=true`
+</ParamField>
 </Accordion>
 
 <Accordion title="Twilio SendGrid">
@@ -410,23 +418,6 @@ SSL: Available on ports 465, 8465, and 443
 </Note>
 </Accordion>
 
-### Custom CA Certificate for Email Service TLS
-
-If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables:
-
-```
-SMTP_PORT=465 # Or your SMTPS/STARTTLS port
-SMTP_CUSTOM_CA_CERT='[BASE64 ENCODED CERTIFICATE PEM]'
-
-# Always keep these as true for custom CA
-SMTP_REQUIRE_TLS=true
-SMTP_TLS_REJECT_UNAUTHORIZED=true
-```
-
-<Note>
-    The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format**. Use the command below to encode your certificate: `echo "<certificate>" | base64`
-</Note>
-
 ## Authentication
 
 By default, users can only login via email/password based login method.