diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/DecryptEnvironmentPostProcessor.java b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/DecryptEnvironmentPostProcessor.java
index 68fe8f90..d3d5c5ba 100644
--- a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/DecryptEnvironmentPostProcessor.java
+++ b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/DecryptEnvironmentPostProcessor.java
@@ -80,7 +80,7 @@ public class DecryptEnvironmentPostProcessor extends AbstractEnvironmentDecrypt
 		KeyProperties keyProperties = binder.bind(KeyProperties.PREFIX, KeyProperties.class)
 				.orElseGet(KeyProperties::new);
 		if (keysConfigured(keyProperties)) {
-
+			setFailOnError(keyProperties.isFailOnError());
 			if (ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", null)) {
 				RsaProperties rsaProperties = binder.bind(RsaProperties.PREFIX, RsaProperties.class)
 						.orElseGet(RsaProperties::new);
diff --git a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
index 55ba62f7..97d8e5b5 100644
--- a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
+++ b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
@@ -26,6 +26,7 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.context.annotation.Configuration;
 
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.BDDAssertions.then;
 
 public class EncryptionIntegrationTests {
@@ -66,6 +67,28 @@ public class EncryptionIntegrationTests {
 		then(context.getBean(PasswordProperties.class).getPassword()).isEqualTo("test");
 	}
 
+	@Test
+	public void symmetricPropertyValuesFailOnError() {
+		assertThatThrownBy(() -> {
+			ConfigurableApplicationContext context = new SpringApplicationBuilder(TestAutoConfiguration.class)
+					.web(WebApplicationType.NONE)
+					.properties("spring.config.use-legacy-processing=false", "encrypt.key:pie",
+							"foo.password:{cipher}ZZZbf29452295df354e6153c5b31b03ef23c70e55fba24299aa85c63438f1c43c95")
+					.run();
+		}).isInstanceOf(IllegalStateException.class).hasMessageContaining("Cannot decrypt");
+	}
+
+	@Test
+	public void symmetricPropertyValuesFailOnErrorFalse() {
+		ConfigurableApplicationContext context = new SpringApplicationBuilder(TestAutoConfiguration.class)
+				.web(WebApplicationType.NONE)
+				.properties("encrypt.fail-on-error=false", "spring.config.use-legacy-processing=false",
+						"encrypt.key:pie",
+						"foo.password:{cipher}ZZZbf29452295df354e6153c5b31b03ef23c70e55fba24299aa85c63438f1c43c95")
+				.run();
+		then(context.getEnvironment().getProperty("foo.password")).isEmpty();
+	}
+
 	@Test
 	public void symmetricPropertyValues() {
 		ConfigurableApplicationContext context = new SpringApplicationBuilder(TestAutoConfiguration.class)