diff --git a/bin/auto_backup.sh b/bin/auto_backup.sh
index a588f4b..64bd1b8 100755
--- a/bin/auto_backup.sh
+++ b/bin/auto_backup.sh
@@ -403,10 +403,20 @@ function backup() {
                         role_arn_option="--role_arn ${BACKUP_S3_ROLE_ARN}"
                     fi
 
-                    add_log "D" "Backup command: cd ${BACKUP_MOBR_DIRNAME} && ${BACKUP_MOBR_PATH} backup ${br_meta_option} --parallelism \"${BACKUP_PHYSICAL_PARALLEL_NUM}\" --host \"${MO_HOST}\" --port \"${MO_PORT}\" --user \"${MO_USER}\" --password \"${MO_PW}\" --backup_dir \"s3\" --endpoint \"${BACKUP_S3_ENDPOINT}\" --access_key_id \"${BACKUP_S3_ID}\" --secret_access_key \"${BACKUP_S3_KEY}\" --bucket \"${BACKUP_S3_BUCKET}\" --filepath \"${backup_outpath}\" --region \"${BACKUP_S3_REGION}\" --compression \"${BACKUP_S3_COMPRESSION}\" \"${role_arn_option}\" \"${minio_option}\" ${delta_option}"
+                    cert_files_option=()
+                    if [[ "${BACKUP_S3_CERT_FILES}" != "" ]]; then
+                        cert_files_option=(--cert_files "${BACKUP_S3_CERT_FILES}")
+                    fi
+
+                    insecure_skip_verify_option=()
+                    if [[ "${BACKUP_S3_INSECURE_SKIP_VERIFY}" == "yes" ]]; then
+                        insecure_skip_verify_option=(--insecure_skip_verify)
+                    fi
+
+                    add_log "D" "Backup command: cd ${BACKUP_MOBR_DIRNAME} && ${BACKUP_MOBR_PATH} backup ${br_meta_option} --parallelism \"${BACKUP_PHYSICAL_PARALLEL_NUM}\" --host \"${MO_HOST}\" --port \"${MO_PORT}\" --user \"${MO_USER}\" --password \"${MO_PW}\" --backup_dir \"s3\" --endpoint \"${BACKUP_S3_ENDPOINT}\" --access_key_id \"${BACKUP_S3_ID}\" --secret_access_key \"${BACKUP_S3_KEY}\" --bucket \"${BACKUP_S3_BUCKET}\" --filepath \"${backup_outpath}\" --region \"${BACKUP_S3_REGION}\" --compression \"${BACKUP_S3_COMPRESSION}\" \"${role_arn_option}\" \"${minio_option}\" ${cert_files_option[*]} ${insecure_skip_verify_option[*]} ${delta_option}"
 
                     startTime=$(get_nanosecond)
-                    if cd ${BACKUP_MOBR_DIRNAME} && ${BACKUP_MOBR_PATH} backup ${br_meta_option} --parallelism "${BACKUP_PHYSICAL_PARALLEL_NUM}" --host "${MO_HOST}" --port "${MO_PORT}" --user "${MO_USER}" --password "${MO_PW}" --backup_dir "s3" --endpoint "${BACKUP_S3_ENDPOINT}" --access_key_id "${BACKUP_S3_ID}" --secret_access_key "${BACKUP_S3_KEY}" --bucket "${BACKUP_S3_BUCKET}" --filepath "${backup_outpath}" --region "${BACKUP_S3_REGION}" --compression "${BACKUP_S3_COMPRESSION}" "${role_arn_option}" "${minio_option}" ${delta_option}; then
+                    if cd ${BACKUP_MOBR_DIRNAME} && ${BACKUP_MOBR_PATH} backup ${br_meta_option} --parallelism "${BACKUP_PHYSICAL_PARALLEL_NUM}" --host "${MO_HOST}" --port "${MO_PORT}" --user "${MO_USER}" --password "${MO_PW}" --backup_dir "s3" --endpoint "${BACKUP_S3_ENDPOINT}" --access_key_id "${BACKUP_S3_ID}" --secret_access_key "${BACKUP_S3_KEY}" --bucket "${BACKUP_S3_BUCKET}" --filepath "${backup_outpath}" --region "${BACKUP_S3_REGION}" --compression "${BACKUP_S3_COMPRESSION}" "${role_arn_option}" "${minio_option}" "${cert_files_option[@]}" "${insecure_skip_verify_option[@]}" ${delta_option}; then
                         outcome="succeeded"
                     else
                         outcome="failed"
diff --git a/conf/env.sh.default b/conf/env.sh.default
index 595d7a9..9244561 100644
--- a/conf/env.sh.default
+++ b/conf/env.sh.default
@@ -245,6 +245,8 @@ BACKUP_S3_REGION=""
 BACKUP_S3_COMPRESSION=""
 BACKUP_S3_ROLE_ARN=""
 BACKUP_S3_IS_MINIO="no"
+BACKUP_S3_CERT_FILES=""
+BACKUP_S3_INSECURE_SKIP_VERIFY="no"
 
 # 2. logical backups
 # mo-dump
@@ -349,4 +351,3 @@ DATAX_CONF_PATH="/data/tools/datax/conf/test.json"
 DATAX_REPORT_FILE="${TOOL_LOG_PATH}/datax.report"
 # parameter lists of datax -p option, e.g. 'db_name,table_name'
 DATAX_PARA_NAME_LIST=""
-
diff --git a/deploy/k8s/backup-full-cronjob.yaml b/deploy/k8s/backup-full-cronjob.yaml
index da2d383..c9e50a4 100644
--- a/deploy/k8s/backup-full-cronjob.yaml
+++ b/deploy/k8s/backup-full-cronjob.yaml
@@ -46,6 +46,10 @@ spec:
               value: /data/logs/mo_ctl
             - name: _CTL_BACKUP_S3_IS_MINIO
               value: "yes"
+            - name: _CTL_BACKUP_S3_CERT_FILES
+              value: "" # optional: comma-separated CA cert files mounted in the container
+            - name: _CTL_BACKUP_S3_INSECURE_SKIP_VERIFY
+              value: "no" # set to "yes" to skip S3 TLS certificate verification
 
             - name: _CTL_CTL_LOG_DIR
               value: "/data/logs/mo_ctl/logs"
diff --git a/deploy/k8s/backup-incr-cronjob.yaml b/deploy/k8s/backup-incr-cronjob.yaml
index 510d62e..b83b57b 100644
--- a/deploy/k8s/backup-incr-cronjob.yaml
+++ b/deploy/k8s/backup-incr-cronjob.yaml
@@ -46,6 +46,10 @@ spec:
               value: /data/logs/mo_ctl
             - name: _CTL_BACKUP_S3_IS_MINIO
               value: "yes"
+            - name: _CTL_BACKUP_S3_CERT_FILES
+              value: "" # optional: comma-separated CA cert files mounted in the container
+            - name: _CTL_BACKUP_S3_INSECURE_SKIP_VERIFY
+              value: "no" # set to "yes" to skip S3 TLS certificate verification
 
             - name: _CTL_CTL_LOG_DIR
               value: "/data/logs/mo_ctl/logs"