diff --git a/testing/tls/tls.go b/testing/tls/tls.go
deleted file mode 100644
index 7858e7333..000000000
--- a/testing/tls/tls.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tls
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"log"
-	"math/big"
-	"time"
-
-	"v2ray.com/core/common"
-	v2tls "v2ray.com/core/transport/internet/tls"
-)
-
-func GenerateCertificateForTest() *v2tls.Certificate {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
-	common.Must(err)
-
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		log.Fatalf("failed to generate serial number: %s", err)
-	}
-
-	template := x509.Certificate{
-		SerialNumber: serialNumber,
-		Subject: pkix.Name{
-			Organization: []string{"V2Ray Inc"},
-		},
-		NotBefore:             time.Now().Add(time.Hour * -1),
-		NotAfter:              time.Now().Add(time.Hour),
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-		DNSNames:              []string{"www.v2ray.com", "v2ray.com"},
-	}
-
-	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
-	common.Must(err)
-
-	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
-	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
-
-	return &v2tls.Certificate{
-		Certificate: certPEM,
-		Key:         keyPEM,
-	}
-}
diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index 9481b2254..340361ef2 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -15,6 +15,7 @@ var (
 	globalSessionCache = tls.NewLRUClientSessionCache(128)
 )
 
+// ParseCertificate converts a cert.Certificate to Certificate.
 func ParseCertificate(c *cert.Certificate) *Certificate {
 	certPEM, keyPEM := c.ToPEM()
 	return &Certificate{
diff --git a/transport/internet/tls/config_test.go b/transport/internet/tls/config_test.go
new file mode 100644
index 000000000..e7fa2fa85
--- /dev/null
+++ b/transport/internet/tls/config_test.go
@@ -0,0 +1,35 @@
+package tls_test
+
+import (
+	gotls "crypto/tls"
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"v2ray.com/core/common/protocol/tls/cert"
+	. "v2ray.com/core/transport/internet/tls"
+	. "v2ray.com/ext/assert"
+)
+
+func TestCertificateIssuing(t *testing.T) {
+	assert := With(t)
+
+	certificate := ParseCertificate(cert.MustGenerate(nil, cert.Authority(true), cert.KeyUsage(x509.KeyUsageCertSign)))
+	certificate.Usage = Certificate_AUTHORITY_ISSUE
+
+	c := &Config{
+		Certificate: []*Certificate{
+			certificate,
+		},
+	}
+
+	tlsConfig := c.GetTLSConfig()
+	v2rayCert, err := tlsConfig.GetCertificate(&gotls.ClientHelloInfo{
+		ServerName: "www.v2ray.com",
+	})
+	assert(err, IsNil)
+
+	x509Cert, err := x509.ParseCertificate(v2rayCert.Certificate[0])
+	assert(err, IsNil)
+	assert(x509Cert.NotAfter.After(time.Now()), IsTrue)
+}