diff --git a/spring-boot/src/main/java/org/springframework/boot/context/embedded/undertow/UndertowEmbeddedServletContainerFactory.java b/spring-boot/src/main/java/org/springframework/boot/context/embedded/undertow/UndertowEmbeddedServletContainerFactory.java
index e3a3e2ff4a4..16ba9a5d7da 100644
--- a/spring-boot/src/main/java/org/springframework/boot/context/embedded/undertow/UndertowEmbeddedServletContainerFactory.java
+++ b/spring-boot/src/main/java/org/springframework/boot/context/embedded/undertow/UndertowEmbeddedServletContainerFactory.java
@@ -294,14 +294,17 @@ public class UndertowEmbeddedServletContainerFactory
 			}
 			KeyStore keyStore = KeyStore.getInstance(keyStoreType);
 			URL url = ResourceUtils.getURL(ssl.getKeyStore());
-			keyStore.load(url.openStream(), ssl.getKeyStorePassword().toCharArray());
+			char[] keyStorePassword = ssl.getKeyStorePassword() != null
+					? ssl.getKeyStorePassword().toCharArray()
+					: null;
+			keyStore.load(url.openStream(), keyStorePassword);
 
 			// Get key manager to provide client credentials.
 			KeyManagerFactory keyManagerFactory = KeyManagerFactory
 					.getInstance(KeyManagerFactory.getDefaultAlgorithm());
 			char[] keyPassword = ssl.getKeyPassword() != null
 					? ssl.getKeyPassword().toCharArray()
-					: ssl.getKeyStorePassword().toCharArray();
+					: keyStorePassword;
 			keyManagerFactory.init(keyStore, keyPassword);
 			return keyManagerFactory.getKeyManagers();
 		}