diff --git a/conf/tfe/tfe.conf b/conf/tfe/tfe.conf
index 918dbd1..ae645ad 100644
--- a/conf/tfe/tfe.conf
+++ b/conf/tfe/tfe.conf
@@ -43,6 +43,9 @@ cert_store_host=192.168.10.8
 cert_store_port=9991
 ca_path=resource/tfe/tango-ca-trust-ca.pem
 untrusted_ca_path=resource/tfe/tango-ca-untrust-ca.pem
+# health_check only for "mode=normal"
+# default 1
+enable_health_check=1
 
 [debug]
 passthrough_all_tcp=0
diff --git a/platform/src/key_keeper.cpp b/platform/src/key_keeper.cpp
index 8156efd..13fb115 100644
--- a/platform/src/key_keeper.cpp
+++ b/platform/src/key_keeper.cpp
@@ -49,6 +49,7 @@ struct key_keeper
 	struct key_keeper_stat stat;
 
 	int cert_expire_time;
+	unsigned int enable_health_check;
 	pthread_t thread;
 };
 
@@ -562,6 +563,7 @@ struct key_keeper* key_keeper_init(const char * profile, const char* section, vo
 	MESA_load_profile_string_def(profile, section, "cert_store_host", keeper->cert_store_host,
 		sizeof(keeper->cert_store_host), "");
 
+	MESA_load_profile_uint_def(profile, section, "enable_health_check", &(keeper->enable_health_check), 1);
 	MESA_load_profile_uint_def(profile, section, "cert_store_port", &(keeper->cert_store_port), 80);
 	MESA_load_profile_uint_def(profile, section, "hash_slot_size", &(keeper->hash_slot_size), 1024*128);
 	MESA_load_profile_uint_def(profile, section, "hash_expire_seconds", &(keeper->hash_expire_seconds), 5*60);
@@ -595,7 +597,7 @@ struct key_keeper* key_keeper_init(const char * profile, const char* section, vo
 		}
 	}
 	// KK_MODE_CERT_STORE: create thread for certstore health check
-	else
+	if (keeper->work_mode == KK_MODE_CERT_STORE && keeper->enable_health_check)
 	{
 		pthread_attr_t attr;
 		pthread_attr_init(&attr);