diff --git a/backend/app/cmd/server_test.go b/backend/app/cmd/server_test.go
index 5b8ce9ab..7ff7c0c2 100644
--- a/backend/app/cmd/server_test.go
+++ b/backend/app/cmd/server_test.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -131,6 +132,58 @@ func TestServerApp_WithMongo(t *testing.T) {
 	app.Wait()
 }
 
+func TestServerApp_WithSSL(t *testing.T) {
+	opts := ServerCommand{}
+	opts.SetCommon(CommonOpts{RemarkURL: "https://localhost:18443", SharedSecret: "123456"})
+
+	// prepare options
+	p := flags.NewParser(&opts, flags.Default)
+	_, err := p.ParseArgs([]string{"--dev-passwd=password", "--port=18080", "--store.bolt.path=/tmp/xyz", "--backup=/tmp", "--avatar.type=bolt", "--avatar.bolt.file=/tmp/ava-test.db", "--notify.type=none",
+		"--ssl.type=static", "--ssl.cert=testdata/cert.pem", "--ssl.key=testdata/key.pem", "--ssl.port=18443"})
+	require.Nil(t, err)
+
+	// create app
+	app, err := opts.newServerApp()
+	require.Nil(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(5 * time.Second)
+		log.Print("[TEST] terminate app")
+		cancel()
+	}()
+	go func() { _ = app.run(ctx) }()
+	time.Sleep(100 * time.Millisecond) // let server start
+
+	client := http.Client{
+		// prevent http redirect
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+
+		// allow self-signed certificate
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+	}
+
+	// check http to https redirect response
+	resp, err := client.Get("http://localhost:18080/blah?param=1")
+	require.Nil(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, 307, resp.StatusCode)
+	assert.Equal(t, "https://localhost:18443/blah?param=1", resp.Header.Get("Location"))
+
+	// check https server
+	resp, err = client.Get("https://localhost:18443/ping")
+	require.Nil(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, 200, resp.StatusCode)
+	body, err := ioutil.ReadAll(resp.Body)
+	assert.Nil(t, err)
+	assert.Equal(t, "pong", string(body))
+}
+
 func TestServerApp_Failed(t *testing.T) {
 	opts := ServerCommand{}
 	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
diff --git a/backend/app/testdata/cert.pem b/backend/app/cmd/testdata/cert.pem
similarity index 100%
rename from backend/app/testdata/cert.pem
rename to backend/app/cmd/testdata/cert.pem
diff --git a/backend/app/testdata/key.pem b/backend/app/cmd/testdata/key.pem
similarity index 100%
rename from backend/app/testdata/key.pem
rename to backend/app/cmd/testdata/key.pem
diff --git a/backend/app/main_test.go b/backend/app/main_test.go
index cc425307..6d3dcc29 100644
--- a/backend/app/main_test.go
+++ b/backend/app/main_test.go
@@ -1,7 +1,6 @@
 package main
 
 import (
-	"crypto/tls"
 	"io/ioutil"
 	"net/http"
 	"os"
@@ -47,56 +46,3 @@ func TestMain(t *testing.T) {
 
 	wg.Wait()
 }
-
-func TestMain_SSLStaticMode(t *testing.T) {
-	os.Args = []string{"test", "server", "--secret=123456", "--store.bolt.path=/tmp/xyz", "--backup=/tmp",
-		"--avatar.fs.path=/tmp", "--port=18080", "--url=https://localhost:18443", "--dbg", "--notify.type=none",
-		"--ssl.type=static", "--ssl.cert=testdata/cert.pem", "--ssl.key=testdata/key.pem", "--ssl.port=18443"}
-
-	go func() {
-		time.Sleep(500 * time.Millisecond)
-		err := syscall.Kill(syscall.Getpid(), syscall.SIGTERM)
-		require.Nil(t, err)
-	}()
-
-	wg := sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		st := time.Now()
-		main()
-		assert.True(t, time.Since(st).Seconds() < 1, "should take about 500msec")
-		wg.Done()
-	}()
-
-	time.Sleep(200 * time.Millisecond) // let server start
-
-	client := http.Client{
-		// prevent http redirect
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-
-		// allow self-signed certificate
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		},
-	}
-
-	// check http to https redirect response
-	resp, err := client.Get("http://localhost:18080/blah?param=1")
-	require.Nil(t, err)
-	defer resp.Body.Close()
-	assert.Equal(t, 307, resp.StatusCode)
-	assert.Equal(t, "https://localhost:18443/blah?param=1", resp.Header.Get("Location"))
-
-	// check https server
-	resp, err = client.Get("https://localhost:18443/ping")
-	require.Nil(t, err)
-	defer resp.Body.Close()
-	assert.Equal(t, 200, resp.StatusCode)
-	body, err := ioutil.ReadAll(resp.Body)
-	assert.Nil(t, err)
-	assert.Equal(t, "pong", string(body))
-
-	wg.Wait()
-}