diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index eba7d2617..4f1d52865 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -57,6 +57,7 @@
 -export([ validate_heap_size/1
         , parse_user_lookup_fun/1
         , validate_alarm_actions/1
+        , validations/0
         ]).
 
 % workaround: prevent being recognized as unused functions
@@ -1602,6 +1603,29 @@ validate_tls_versions(Versions) ->
         Vs -> {error, {unsupported_ssl_versions, Vs}}
     end.
 
+validations() ->
+    [{check_process_watermark, fun check_process_watermark/1}
+    ,{check_cpu_watermark, fun check_cpu_watermark/1}
+    ].
+
+%% validations from emqx_conf_schema, we must filter other *_schema by undefined.
+check_process_watermark(Conf) ->
+    check_watermark("sysmon.vm.process_low_watermark", "sysmon.vm.process_high_watermark", Conf).
+
+check_cpu_watermark(Conf) ->
+    check_watermark("sysmon.os.cpu_low_watermark", "sysmon.os.cpu_high_watermark", Conf).
+
+check_watermark(LowKey, HighKey, Conf) ->
+    case hocon_maps:get(LowKey, Conf) of
+        undefined -> true;
+        Low ->
+            High = hocon_maps:get(HighKey, Conf),
+            case Low < High of
+                true -> true;
+                false -> {bad_watermark, #{LowKey => Low, HighKey => High}}
+            end
+    end.
+
 str(A) when is_atom(A) ->
     atom_to_list(A);
 str(B) when is_binary(B) ->
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index 779cc52ae..b5bee052f 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -205,27 +205,37 @@ transform_header_name(Headers) ->
                       maps:put(K, V, Acc)
               end, #{}, Headers).
 
-check_ssl_opts(Conf)
-  when Conf =:= #{} ->
-    true;
 check_ssl_opts(Conf) ->
-    case emqx_authz_http:parse_url(hocon_maps:get("config.url", Conf)) of
-        #{scheme := https} ->
-            case hocon_maps:get("config.ssl.enable", Conf) of
-                true -> ok;
-                false -> false
-            end;
-        #{scheme := http} ->
-            ok
+    case hocon_maps:get("config.url", Conf) of
+        undefined -> true;
+        Url ->
+            case emqx_authz_http:parse_url(Url) of
+                #{scheme := https} ->
+                    case hocon_maps:get("config.ssl.enable", Conf) of
+                        true -> true;
+                        _ -> {error, ssl_not_enable}
+                    end;
+                #{scheme := http} -> true;
+                Bad -> {bad_scheme, Url, Bad}
+            end
     end.
 
-check_headers(Conf)
-    when Conf =:= #{} ->
-    true;
 check_headers(Conf) ->
-    Method = to_bin(hocon_maps:get("config.method", Conf)),
-    Headers = hocon_maps:get("config.headers", Conf),
-    Method =:= <<"post">> orelse (not lists:member(<<"content-type">>, Headers)).
+    case hocon_maps:get("config.method", Conf) of
+        undefined -> true;
+        Method0 ->
+            Method = to_bin(Method0),
+            Headers = hocon_maps:get("config.headers", Conf),
+            case Method of
+                <<"post">> -> true;
+                _ when Headers =:= undefined -> true;
+                _ when is_list(Headers) ->
+                    case lists:member(<<"content-type">>, Headers) of
+                        false -> true;
+                        true -> {Method0, do_not_include_content_type}
+                    end
+            end
+    end.
 
 union_array(Item) when is_list(Item) ->
     hoconsc:array(hoconsc:union(Item)).
diff --git a/apps/emqx_conf/src/emqx_conf_schema.erl b/apps/emqx_conf/src/emqx_conf_schema.erl
index d15e10136..aaf1966bd 100644
--- a/apps/emqx_conf/src/emqx_conf_schema.erl
+++ b/apps/emqx_conf/src/emqx_conf_schema.erl
@@ -36,7 +36,7 @@
                 file/0,
                 cipher/0]).
 
--export([namespace/0, roots/0, fields/1, translations/0, translation/1]).
+-export([namespace/0, roots/0, fields/1, translations/0, translation/1, validations/0]).
 -export([conf_get/2, conf_get/3, keys/2, filter/1]).
 
 %% Static apps which merge their configs into the merged emqx.conf
@@ -103,6 +103,10 @@ roots() ->
     emqx_schema:roots(low) ++
     lists:flatmap(fun roots/1, ?MERGED_CONFIGS).
 
+validations() ->
+    hocon_schema:validations(emqx_schema) ++
+    lists:flatmap(fun hocon_schema:validations/1, ?MERGED_CONFIGS).
+
 fields("cluster") ->
     [ {"name",
        sc(atom(),
diff --git a/lib-ee/emqx_license/src/emqx_license_checker.erl b/lib-ee/emqx_license/src/emqx_license_checker.erl
index b8ddd2d42..e0d511181 100644
--- a/lib-ee/emqx_license/src/emqx_license_checker.erl
+++ b/lib-ee/emqx_license/src/emqx_license_checker.erl
@@ -122,8 +122,12 @@ ensure_check_expiry_timer(State) ->
     Ref = erlang:send_after(?EXPIRY_ALARM_CHECK_INTERVAL, self(), check_expiry_alarm),
     State#{expiry_alarm_timer => Ref}.
 
-cancel_timer(#{Key := Ref}, Key) when is_reference(Ref) -> erlang:cancel_timer(Ref);
-cancel_timer(_, _) -> ok.
+cancel_timer(State, Key) ->
+    Ref = maps:get(Key, State),
+    case is_reference(Ref) of
+        true -> erlang:cancel_timer(Ref);
+        false -> ok
+    end.
 
 check_license(License) ->
     DaysLeft = days_left(License),