diff --git a/pulsar-functions/instance/src/main/python/python_instance.py b/pulsar-functions/instance/src/main/python/python_instance.py
index 2ab3ccc46171c..7e295470c4e18 100755
--- a/pulsar-functions/instance/src/main/python/python_instance.py
+++ b/pulsar-functions/instance/src/main/python/python_instance.py
@@ -581,13 +581,16 @@ def get_record_class(self, class_name):
         except:
           pass
       return record_kclass
+
   def get_crypto_reader(self, crypto_spec):
     crypto_key_reader = None
     if crypto_spec is not None:
       try:
-        crypto_config = json.loads(crypto_spec.cryptoKeyReaderConfig)
-        if crypto_spec.cryptoKeyReaderClassName == "" or crypto_spec.cryptoKeyReaderClassName is None:
-          crypto_key_reader = pulsar.CryptoKeyReader(**crypto_config)
+        crypto_config = json.loads(crypto_spec.cryptoKeyReaderConfig) if crypto_spec.cryptoKeyReaderConfig else {}
+        # use the default crypto key reader
+        if not crypto_spec.cryptoKeyReaderClassName:
+          if "public_key_path" in crypto_config and "private_key_path" in crypto_config:
+            crypto_key_reader = pulsar.CryptoKeyReader(**crypto_config)
         else:
           crypto_key_reader = util.import_class(os.path.dirname(self.user_code), crypto_spec.cryptoKeyReaderClassName)(**crypto_config)
       except Exception as e:
diff --git a/tests/integration/src/test/java/org/apache/pulsar/tests/integration/functions/PulsarFunctionsTest.java b/tests/integration/src/test/java/org/apache/pulsar/tests/integration/functions/PulsarFunctionsTest.java
index fdda3144e8bd4..eb0d9037b741a 100644
--- a/tests/integration/src/test/java/org/apache/pulsar/tests/integration/functions/PulsarFunctionsTest.java
+++ b/tests/integration/src/test/java/org/apache/pulsar/tests/integration/functions/PulsarFunctionsTest.java
@@ -777,6 +777,9 @@ protected void testExclamationFunction(Runtime runtime,
                 batchingConfig = producerConfig.getBatchingConfig();
             }
             checkLogs(functionName, batchingConfig, consumerConfig, config, inputTopicName);
+        } else if (runtime == Runtime.PYTHON) {
+            String functionLogs = pulsarCluster.getFunctionLogs(functionName);
+            assertFalse(functionLogs.contains("Failed to load the crypto key reader from spec"));
         }
 
         // get function status