diff --git a/cli/flags.rs b/cli/flags.rs
index 7d9ba8fdbd..efd0a5c630 100644
--- a/cli/flags.rs
+++ b/cli/flags.rs
@@ -186,6 +186,7 @@ static ENV_VARIABLES_HELP: &str = "ENVIRONMENT VARIABLES:
     DENO_DIR             Set the cache directory
     DENO_INSTALL_ROOT    Set deno install's output directory
                          (defaults to $HOME/.deno/bin)
+    DENO_CERT            Load certificate authority from PEM encoded file
     NO_COLOR             Set to disable color
     HTTP_PROXY           Proxy address for HTTP requests
                          (module downloads, fetch)
diff --git a/cli/global_state.rs b/cli/global_state.rs
index e9988f4b57..3290be25f1 100644
--- a/cli/global_state.rs
+++ b/cli/global_state.rs
@@ -58,6 +58,10 @@ impl GlobalState {
     let dir = deno_dir::DenoDir::new(custom_root)?;
     let deps_cache_location = dir.root.join("deps");
     let http_cache = http_cache::HttpCache::new(&deps_cache_location);
+    let ca_file = flags
+      .ca_file
+      .clone()
+      .or_else(|| env::var("DENO_CERT").map(String::into).ok());
 
     let file_fetcher = SourceFileFetcher::new(
       http_cache,
@@ -65,7 +69,7 @@ impl GlobalState {
       flags.cache_blocklist.clone(),
       flags.no_remote,
       flags.cached_only,
-      flags.ca_file.clone(),
+      ca_file,
     )?;
 
     let ts_compiler = TsCompiler::new(
diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index f064c4db18..9354546369 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -2182,6 +2182,27 @@ itest!(deno_lint_glob {
   exit_code: 1,
 });
 
+#[test]
+fn cafile_env_fetch() {
+  use url::Url;
+  let g = util::http_server();
+  let deno_dir = TempDir::new().expect("tempdir fail");
+  let module_url =
+    Url::parse("https://localhost:5545/cli/tests/cafile_url_imports.ts")
+      .unwrap();
+  let cafile = util::root_path().join("cli/tests/tls/RootCA.pem");
+  let output = Command::new(util::deno_exe_path())
+    .env("DENO_DIR", deno_dir.path())
+    .env("DENO_CERT", cafile)
+    .current_dir(util::root_path())
+    .arg("cache")
+    .arg(module_url.to_string())
+    .output()
+    .expect("Failed to spawn script");
+  assert!(output.status.success());
+  drop(g);
+}
+
 #[test]
 fn cafile_fetch() {
   use url::Url;