diff --git a/apps/emqx_psk/src/emqx_psk.erl b/apps/emqx_psk/src/emqx_psk.erl
index bd04c349d..01f3cfa09 100644
--- a/apps/emqx_psk/src/emqx_psk.erl
+++ b/apps/emqx_psk/src/emqx_psk.erl
@@ -56,6 +56,10 @@
 -define(CR, 13).
 -define(LF, 10).
 
+-ifdef(TEST).
+-export([call/1, trim_crlf/1]).
+-endif.
+
 %%------------------------------------------------------------------------------
 %% Mnesia bootstrap
 %%------------------------------------------------------------------------------
@@ -79,7 +83,7 @@ load() ->
     emqx:hook('tls_handshake.psk_lookup', {?MODULE, on_psk_lookup, []}).
 
 unload() ->
-    emqx:unhook('tls_handshake.psk_lookup', {?MODULE, on_psk_lookup, []}).
+    emqx:unhook('tls_handshake.psk_lookup', {?MODULE, on_psk_lookup}).
 
 on_psk_lookup(PSKIdentity, _UserState) ->
     case mnesia:dirty_read(?TAB, PSKIdentity) of
diff --git a/apps/emqx_psk/src/emqx_psk_schema.erl b/apps/emqx_psk/src/emqx_psk_schema.erl
index a8a870ea1..5d85b4675 100644
--- a/apps/emqx_psk/src/emqx_psk_schema.erl
+++ b/apps/emqx_psk/src/emqx_psk_schema.erl
@@ -24,6 +24,8 @@
         , fields/1
         ]).
 
+-import(emqx_schema, [sc/2]).
+
 roots() -> ["psk_authentication"].
 
 fields("psk_authentication") ->
@@ -42,35 +44,27 @@ to which is configurable by the <code>init_file</code> field.
      }.
 
 fields() ->
-    [ {enable, fun enable/1}
-    , {init_file, fun init_file/1}
-    , {separator, fun separator/1}
-    , {chunk_size, fun chunk_size/1}
+    [ {enable, sc(boolean(), #{default => false,
+                               desc => <<"Whether to enable TLS PSK support">>
+                              })}
+    , {init_file, sc(binary(),
+                     #{required => false,
+                       desc =>
+                           <<"If init_file is specified, emqx will import PSKs from the file ",
+                             "into the built-in database at startup for use by the runtime. ",
+                             "The file has to be structured line-by-line, each line must be in ",
+                             "the format of <code>PSKIdentity:SharedSecret</code>. For example: ",
+                             "<code>mydevice1:c2VjcmV0</code>">>
+                      })}
+    , {separator, sc(binary(),
+                     #{default => <<":">>,
+                       desc =>
+                           <<"The separator between <code>PSKIdentity</code"
+                             " and <code>SharedSecret</code> in the psk file">>
+                      })}
+    , {chunk_size, sc(integer(),
+                      #{default => 50,
+                        desc => <<"The size of each chunk used to import to"
+                                  " the built-in database from psk file">>
+                       })}
     ].
-
-enable(type) -> boolean();
-enable(desc) -> <<"Whether to enable TLS PSK support">>;
-enable(default) -> false;
-enable(_) -> undefined.
-
-init_file(type) -> binary();
-init_file(desc) ->
-    <<"If init_file is specified, emqx will import PSKs from the file ",
-      "into the built-in database at startup for use by the runtime. ",
-      "The file has to be structured line-by-line, each line must be in ",
-      "the format of <code>PSKIdentity:SharedSecret</code>. For example: ",
-      "<code>mydevice1:c2VjcmV0</code>">>;
-init_file(required) -> false;
-init_file(_) -> undefined.
-
-separator(type) -> binary();
-separator(desc) ->
-    <<"The separator between <code>PSKIdentity</code> and <code>SharedSecret</code> in the psk file">>;
-separator(default) -> <<":">>;
-separator(_) -> undefined.
-
-chunk_size(type) -> integer();
-chunk_size(desc) ->
-    <<"The size of each chunk used to import to the built-in database from psk file">>;
-chunk_size(default) -> 50;
-chunk_size(_) -> undefined.
diff --git a/apps/emqx_psk/test/emqx_psk_SUITE.erl b/apps/emqx_psk/test/emqx_psk_SUITE.erl
index 1dd23d797..e48f63209 100644
--- a/apps/emqx_psk/test/emqx_psk_SUITE.erl
+++ b/apps/emqx_psk/test/emqx_psk_SUITE.erl
@@ -21,6 +21,9 @@
 -include_lib("common_test/include/ct.hrl").
 -include_lib("eunit/include/eunit.hrl").
 
+-define(CR, 13).
+-define(LF, 10).
+
 all() ->
     emqx_common_test_helpers:all(?MODULE).
 
@@ -83,3 +86,36 @@ t_psk_lookup(_) ->
 
     ok.
 
+t_start_stop(_) ->
+    ?assertNotEqual(undefined, erlang:whereis(emqx_psk)),
+
+    ?assertEqual(ok, emqx_psk:stop()),
+
+    timer:sleep(1000),
+
+    ?assertNotEqual(undefined, erlang:whereis(emqx_psk)).
+
+t_unexpected(_) ->
+    ?assertEqual({error, unexpected}, emqx_psk:call(unexpected)),
+    ?assertEqual(ok, gen_server:cast(emqx_psk, unexpected)),
+    ?assertEqual(unexpected, erlang:send(erlang:whereis(emqx_psk), unexpected)).
+
+t_load_unload(_) ->
+    emqx_psk:unload(),
+    timer:sleep(600),
+    ?assertEqual([], emqx_hooks:lookup('tls_handshake.psk_lookup')),
+
+    emqx_psk:load(),
+    ?assertMatch([_Hook], emqx_hooks:lookup('tls_handshake.psk_lookup')).
+
+t_import(_) ->
+    Init = emqx_conf:get([psk_authentication, init_file], undefined),
+    ?assertEqual(ok, emqx_psk:import(Init)),
+    ?assertMatch({error, _}, emqx_psk:import("~/_none_")),
+    ok.
+
+t_trim_crlf(_) ->
+    Bin = <<1, 2>>,
+    ?assertEqual(Bin, emqx_psk:trim_crlf(Bin)),
+    ?assertEqual(Bin, emqx_psk:trim_crlf(<<Bin/binary, ?LF>>)),
+    ?assertEqual(Bin, emqx_psk:trim_crlf(<<Bin/binary, ?CR, ?LF>>)).