diff --git a/Knot.files b/Knot.files
index 28b221adf2b7e0cbee38f7841d205d97bf0c2b7f..29f8714f28e20daea609aaa90c4d79ee1731c9ac 100644
--- a/Knot.files
+++ b/Knot.files
@@ -126,26 +126,6 @@ src/dnssec/shared/keyid_gnutls.h
 src/dnssec/shared/pem.c
 src/dnssec/shared/pem.h
 src/dnssec/shared/shared.h
-src/dnssec/tests/binary.c
-src/dnssec/tests/crypto.c
-src/dnssec/tests/key.c
-src/dnssec/tests/key_algorithm.c
-src/dnssec/tests/key_ds.c
-src/dnssec/tests/keyid.c
-src/dnssec/tests/keystore_pkcs11.c
-src/dnssec/tests/keystore_pkcs8.c
-src/dnssec/tests/keystore_pkcs8_dir.c
-src/dnssec/tests/keytag.c
-src/dnssec/tests/list.c
-src/dnssec/tests/nsec_bitmap.c
-src/dnssec/tests/nsec_hash.c
-src/dnssec/tests/random.c
-src/dnssec/tests/sample_keys.h
-src/dnssec/tests/shared_bignum.c
-src/dnssec/tests/shared_dname.c
-src/dnssec/tests/sign.c
-src/dnssec/tests/sign_der.c
-src/dnssec/tests/tsig.c
 src/knot/common/evsched.c
 src/knot/common/evsched.h
 src/knot/common/fdset.c
@@ -475,6 +455,51 @@ tests/contrib/test_string.c
 tests/contrib/test_strtonum.c
 tests/contrib/test_time.c
 tests/contrib/test_wire_ctx.c
+tests/dnssec/sample_keys.h
+tests/dnssec/test_binary.c
+tests/dnssec/test_crypto.c
+tests/dnssec/test_key.c
+tests/dnssec/test_key_algorithm.c
+tests/dnssec/test_key_ds.c
+tests/dnssec/test_keyid.c
+tests/dnssec/test_keystore_pkcs11.c
+tests/dnssec/test_keystore_pkcs8.c
+tests/dnssec/test_keystore_pkcs8_dir.c
+tests/dnssec/test_keytag.c
+tests/dnssec/test_list.c
+tests/dnssec/test_nsec_bitmap.c
+tests/dnssec/test_nsec_hash.c
+tests/dnssec/test_random.c
+tests/dnssec/test_shared_bignum.c
+tests/dnssec/test_shared_dname.c
+tests/dnssec/test_sign.c
+tests/dnssec/test_sign_der.c
+tests/dnssec/test_tsig.c
+tests/knot/test_acl.c
+tests/knot/test_changeset.c
+tests/knot/test_conf.c
+tests/knot/test_conf.h
+tests/knot/test_conf_tools.c
+tests/knot/test_confdb.c
+tests/knot/test_confio.c
+tests/knot/test_dthreads.c
+tests/knot/test_fdset.c
+tests/knot/test_journal.c
+tests/knot/test_kasp_db.c
+tests/knot/test_node.c
+tests/knot/test_process_query.c
+tests/knot/test_query_module.c
+tests/knot/test_requestor.c
+tests/knot/test_server.c
+tests/knot/test_server.h
+tests/knot/test_worker_pool.c
+tests/knot/test_worker_queue.c
+tests/knot/test_zone-tree.c
+tests/knot/test_zone-update.c
+tests/knot/test_zone_events.c
+tests/knot/test_zone_serial.c
+tests/knot/test_zone_timers.c
+tests/knot/test_zonedb.c
 tests/libknot/test_control.c
 tests/libknot/test_cookies.c
 tests/libknot/test_db.c
@@ -496,30 +521,5 @@ tests/libknot/test_ypschema.c
 tests/libknot/test_yptrafo.c
 tests/modules/test_onlinesign.c
 tests/modules/test_rrl.c
-tests/test_acl.c
-tests/test_changeset.c
-tests/test_conf.c
-tests/test_conf.h
-tests/test_conf_tools.c
-tests/test_confdb.c
-tests/test_confio.c
-tests/test_dthreads.c
-tests/test_fdset.c
-tests/test_journal.c
-tests/test_kasp_db.c
-tests/test_node.c
-tests/test_process_query.c
-tests/test_query_module.c
-tests/test_requestor.c
-tests/test_server.c
-tests/test_server.h
-tests/test_worker_pool.c
-tests/test_worker_queue.c
-tests/test_zone-tree.c
-tests/test_zone-update.c
-tests/test_zone_events.c
-tests/test_zone_serial.c
-tests/test_zone_timers.c
-tests/test_zonedb.c
 tests/utils/test_cert.c
 tests/utils/test_lookup.c
diff --git a/configure.ac b/configure.ac
index 1b28be22a45629ea92f4b02e81f7477e9f00dbf4..d32fa9cfa94eb501a4c6142e76ab982c2f70b366 100644
--- a/configure.ac
+++ b/configure.ac
@@ -589,7 +589,6 @@ AC_CONFIG_FILES([Makefile
                  src/Makefile
                  src/contrib/dnstap/Makefile
                  src/dnssec/Makefile
-                 src/dnssec/tests/Makefile
                  src/knot/modules/static_modules.h
                  src/zscanner/Makefile
                  ])
diff --git a/src/dnssec/Makefile.am b/src/dnssec/Makefile.am
index 282e0d7fe01fceeba9c935241c1c72260a815747..8e8e11f5cfdf73bd344920383a4f69f375622be7 100644
--- a/src/dnssec/Makefile.am
+++ b/src/dnssec/Makefile.am
@@ -1,9 +1,3 @@
-SUBDIRS = . tests
-
-.PHONY: check-compile
-check-compile:
-	$(MAKE) $(AM_MAKEFLAGS) -C tests $@
-
 AM_CPPFLAGS = \
 	-include $(top_builddir)/src/config.h \
 	-I$(srcdir)/shared \
diff --git a/src/dnssec/tests/.gitignore b/src/dnssec/tests/.gitignore
deleted file mode 100644
index dd9671d4193b0868c2094586044ca7bcd358645f..0000000000000000000000000000000000000000
--- a/src/dnssec/tests/.gitignore
+++ /dev/null
@@ -1,27 +0,0 @@
-/Makefile
-/Makefile.in
-/runtests.log
-
-# test binaries
-/binary
-/crypto
-/key
-/key_algorithm
-/key_ds
-/keyid
-/keystore_pkcs11
-/keystore_pkcs8
-/keystore_pkcs8_dir
-/keytag
-/list
-/nsec_bitmap
-/nsec_hash
-/random
-/shared_base32hex
-/shared_bignum
-/shared_dname
-/shared_timestamp
-/shared_wire
-/sign
-/sign_der
-/tsig
diff --git a/src/dnssec/tests/Makefile.am b/src/dnssec/tests/Makefile.am
deleted file mode 100644
index ae85ba523241119fda99cf78838a4a075989589d..0000000000000000000000000000000000000000
--- a/src/dnssec/tests/Makefile.am
+++ /dev/null
@@ -1,55 +0,0 @@
-AM_CPPFLAGS = \
-	-include $(top_builddir)/src/config.h \
-	-I$(top_srcdir)/libtap \
-	-I$(srcdir)/../shared \
-	-I$(srcdir)/../lib \
-	-I$(srcdir)/../lib/dnssec \
-	-I$(top_srcdir)/src \
-	$(gnutls_CFLAGS)
-
-AM_LDFLAGS = \
-	-static
-
-LDADD = \
-	$(top_builddir)/libtap/libtap.la \
-	$(builddir)/../libdnssec.la
-
-CLEANFILES = runtests.log
-
-EXTRA_DIST = sample_keys.h
-
-check_PROGRAMS = \
-	binary		\
-	crypto		\
-	key		\
-	key_algorithm	\
-	key_ds		\
-	keyid		\
-	keystore_pkcs11 \
-	keystore_pkcs8	\
-	keystore_pkcs8_dir \
-	keytag		\
-	list		\
-	nsec_bitmap	\
-	nsec_hash	\
-	random		\
-	sign		\
-	sign_der	\
-	shared_bignum	\
-	shared_dname	\
-	tsig
-
-keystore_pkcs11_CPPFLAGS = $(AM_CPPFLAGS) -DLIBDIR='"$(libdir)"'
-
-check-compile: $(check_PROGRAMS)
-
-AM_V_RUNTESTS = $(am__v_RUNTESTS_@AM_V@)
-am__v_RUNTESTS_ = $(am__v_RUNTESTS_@AM_DEFAULT_V@)
-am__v_RUNTESTS_0 =
-am__v_RUNTESTS_1 = RET=$$?; if [ "$$RET" != "0" ]; then cat "$(builddir)/runtests.log"; exit $$RET; fi
-check-local: $(check_PROGRAMS)
-	@$(top_builddir)/libtap/runtests -s $(srcdir) \
-					-b $(builddir) \
-					-L $(builddir)/runtests.log \
-					$(check_PROGRAMS); \
-	$(AM_V_RUNTESTS)
diff --git a/tests/.gitignore b/tests/.gitignore
index 054ac8453680312ee388777857235cbc3b6f8e26..d16f4525ea180914823ef4c018ea54ec691be903 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -16,6 +16,26 @@
 /contrib/test_time
 /contrib/test_wire_ctx
 
+/dnssec/test_binary
+/dnssec/test_crypto
+/dnssec/test_key
+/dnssec/test_key_algorithm
+/dnssec/test_key_ds
+/dnssec/test_keyid
+/dnssec/test_keystore_pkcs11
+/dnssec/test_keystore_pkcs8
+/dnssec/test_keystore_pkcs8_dir
+/dnssec/test_keytag
+/dnssec/test_list
+/dnssec/test_nsec_bitmap
+/dnssec/test_nsec_hash
+/dnssec/test_random
+/dnssec/test_sign
+/dnssec/test_sign_der
+/dnssec/test_shared_bignum
+/dnssec/test_shared_dname
+/dnssec/test_tsig
+
 /knot/test_acl
 /knot/test_changeset
 /knot/test_conf
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d4cc6367cb2211c14fb19f1d1cae0740d992d6c1..ac1a44c0b1898d413b137f34c4c3ef7f50f40571 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -2,14 +2,19 @@ AM_CPPFLAGS = \
 	-include $(top_builddir)/src/config.h \
 	-I$(top_srcdir)/libtap \
 	-I$(top_srcdir)/src \
-	-I$(top_srcdir)/src/dnssec/lib
+	-I$(top_srcdir)/src/dnssec/lib \
+	-I$(top_srcdir)/src/dnssec/shared \
+	-I$(top_srcdir)/src/dnssec/lib/dnssec \
+	$(gnutls_CFLAGS)
 
 LDADD = \
 	$(top_builddir)/libtap/libtap.la \
+	$(top_builddir)/src/dnssec/libdnssec.la \
 	$(top_builddir)/src/libknot.la \
 	$(top_builddir)/src/libknotd.la \
-	$(top_builddir)/src/libcontrib.la \
-	$(libcrypto_LIBS)
+	$(top_builddir)/src/libcontrib.la
+
+EXTRA_DIST = dnssec/sample_keys.h
 
 check_PROGRAMS = \
 	contrib/test_base32hex		\
@@ -26,6 +31,27 @@ check_PROGRAMS = \
 	contrib/test_time		\
 	contrib/test_wire_ctx
 
+check_PROGRAMS += \
+	dnssec/test_binary		\
+	dnssec/test_crypto		\
+	dnssec/test_key			\
+	dnssec/test_key_algorithm	\
+	dnssec/test_key_ds		\
+	dnssec/test_keyid		\
+	dnssec/test_keystore_pkcs11	\
+	dnssec/test_keystore_pkcs8	\
+	dnssec/test_keystore_pkcs8_dir	\
+	dnssec/test_keytag		\
+	dnssec/test_list		\
+	dnssec/test_nsec_bitmap		\
+	dnssec/test_nsec_hash		\
+	dnssec/test_random		\
+	dnssec/test_sign		\
+	dnssec/test_sign_der		\
+	dnssec/test_shared_bignum	\
+	dnssec/test_shared_dname	\
+	dnssec/test_tsig
+
 check_PROGRAMS += \
 	knot/test_acl			\
 	knot/test_changeset		\
@@ -96,6 +122,10 @@ check_PROGRAMS += \
 endif
 endif
 
+dnssec_keystore_pkcs11_CPPFLAGS = \
+	$(AM_CPPFLAGS) \
+	-DLIBDIR='"$(libdir)"'
+
 utils_test_lookup_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
 	$(libedit_CFLAGS)
@@ -107,8 +137,7 @@ utils_test_lookup_LDADD = \
 
 utils_test_cert_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
-	$(libedit_CFLAGS) \
-	$(gnutls_CFLAGS)
+	$(libedit_CFLAGS)
 
 utils_test_cert_LDADD = \
 	$(top_builddir)/libtap/libtap.la \
diff --git a/src/dnssec/tests/sample_keys.h b/tests/dnssec/sample_keys.h
similarity index 100%
rename from src/dnssec/tests/sample_keys.h
rename to tests/dnssec/sample_keys.h
diff --git a/src/dnssec/tests/binary.c b/tests/dnssec/test_binary.c
similarity index 100%
rename from src/dnssec/tests/binary.c
rename to tests/dnssec/test_binary.c
diff --git a/src/dnssec/tests/crypto.c b/tests/dnssec/test_crypto.c
similarity index 100%
rename from src/dnssec/tests/crypto.c
rename to tests/dnssec/test_crypto.c
diff --git a/src/dnssec/tests/key.c b/tests/dnssec/test_key.c
similarity index 100%
rename from src/dnssec/tests/key.c
rename to tests/dnssec/test_key.c
diff --git a/src/dnssec/tests/key_algorithm.c b/tests/dnssec/test_key_algorithm.c
similarity index 100%
rename from src/dnssec/tests/key_algorithm.c
rename to tests/dnssec/test_key_algorithm.c
diff --git a/src/dnssec/tests/key_ds.c b/tests/dnssec/test_key_ds.c
similarity index 100%
rename from src/dnssec/tests/key_ds.c
rename to tests/dnssec/test_key_ds.c
diff --git a/src/dnssec/tests/keyid.c b/tests/dnssec/test_keyid.c
similarity index 100%
rename from src/dnssec/tests/keyid.c
rename to tests/dnssec/test_keyid.c
diff --git a/src/dnssec/tests/keystore_pkcs11.c b/tests/dnssec/test_keystore_pkcs11.c
similarity index 100%
rename from src/dnssec/tests/keystore_pkcs11.c
rename to tests/dnssec/test_keystore_pkcs11.c
diff --git a/src/dnssec/tests/keystore_pkcs8.c b/tests/dnssec/test_keystore_pkcs8.c
similarity index 100%
rename from src/dnssec/tests/keystore_pkcs8.c
rename to tests/dnssec/test_keystore_pkcs8.c
diff --git a/src/dnssec/tests/keystore_pkcs8_dir.c b/tests/dnssec/test_keystore_pkcs8_dir.c
similarity index 97%
rename from src/dnssec/tests/keystore_pkcs8_dir.c
rename to tests/dnssec/test_keystore_pkcs8_dir.c
index 9704d809336a9025dd84891b9f71dd7e7795c0f4..124b8c361eb14506f04b9757c1ffb0ea7868d6dc 100644
--- a/src/dnssec/tests/keystore_pkcs8_dir.c
+++ b/tests/dnssec/test_keystore_pkcs8_dir.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -23,6 +23,7 @@
 #include "error.h"
 #include "key.h"
 #include "keystore.h"
+#include "keystore/pkcs8_dir.c"
 
 typedef struct test_pem {
 	const char *id;
diff --git a/src/dnssec/tests/keytag.c b/tests/dnssec/test_keytag.c
similarity index 100%
rename from src/dnssec/tests/keytag.c
rename to tests/dnssec/test_keytag.c
diff --git a/src/dnssec/tests/list.c b/tests/dnssec/test_list.c
similarity index 100%
rename from src/dnssec/tests/list.c
rename to tests/dnssec/test_list.c
diff --git a/src/dnssec/tests/nsec_bitmap.c b/tests/dnssec/test_nsec_bitmap.c
similarity index 100%
rename from src/dnssec/tests/nsec_bitmap.c
rename to tests/dnssec/test_nsec_bitmap.c
diff --git a/src/dnssec/tests/nsec_hash.c b/tests/dnssec/test_nsec_hash.c
similarity index 100%
rename from src/dnssec/tests/nsec_hash.c
rename to tests/dnssec/test_nsec_hash.c
diff --git a/src/dnssec/tests/random.c b/tests/dnssec/test_random.c
similarity index 100%
rename from src/dnssec/tests/random.c
rename to tests/dnssec/test_random.c
diff --git a/src/dnssec/tests/shared_bignum.c b/tests/dnssec/test_shared_bignum.c
similarity index 100%
rename from src/dnssec/tests/shared_bignum.c
rename to tests/dnssec/test_shared_bignum.c
diff --git a/src/dnssec/tests/shared_dname.c b/tests/dnssec/test_shared_dname.c
similarity index 100%
rename from src/dnssec/tests/shared_dname.c
rename to tests/dnssec/test_shared_dname.c
diff --git a/src/dnssec/tests/sign.c b/tests/dnssec/test_sign.c
similarity index 100%
rename from src/dnssec/tests/sign.c
rename to tests/dnssec/test_sign.c
diff --git a/src/dnssec/tests/sign_der.c b/tests/dnssec/test_sign_der.c
similarity index 98%
rename from src/dnssec/tests/sign_der.c
rename to tests/dnssec/test_sign_der.c
index a31afb199787b4309d9e357c2464ba6c4a21f383..04bfeac5ee3c98118bacb51ecb2afbf4d3ea1318 100644
--- a/src/dnssec/tests/sign_der.c
+++ b/tests/dnssec/test_sign_der.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -21,7 +21,7 @@
 
 #include "binary.h"
 #include "error.h"
-#include "sign/der.h"
+#include "sign/der.c"
 
 static int binary_eq(const dnssec_binary_t *a, const dnssec_binary_t *b)
 {
diff --git a/src/dnssec/tests/tsig.c b/tests/dnssec/test_tsig.c
similarity index 100%
rename from src/dnssec/tests/tsig.c
rename to tests/dnssec/test_tsig.c
diff --git a/tests/knot/semantic_check_data/Makefile.inc b/tests/knot/semantic_check_data/Makefile.inc
index a89dd9ce4cc78eb62dc88f0c5838f22bd8e9bc20..9005c312acafe7343dea645a087608b6978ccea1 100644
--- a/tests/knot/semantic_check_data/Makefile.inc
+++ b/tests/knot/semantic_check_data/Makefile.inc
@@ -11,6 +11,6 @@ knot/test_semantic_check: $(top_srcdir)/tests/knot/test_semantic_check.in
 	@$(edit) < $(top_srcdir)/tests/knot/test_semantic_check.in > $(top_builddir)/tests/knot/test_semantic_check
 	@chmod +x $(top_builddir)/tests/knot/test_semantic_check
 
-EXTRA_DIST = \
+EXTRA_DIST += \
 	knot/test_semantic_check.in \
 	knot/semantic_check_data