diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java
index 2056d0256c1..d2126d77618 100644
--- a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java
+++ b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java
@@ -111,8 +111,7 @@ public class SniX509ExtendedKeyManager extends X509ExtendedKeyManager
     public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket)
     {
         SSLSocket sslSocket = (SSLSocket)socket;
-
-        String alias = chooseServerAlias(keyType,issuers,sslSocket.getSSLParameters().getSNIMatchers(),sslSocket.getHandshakeSession());
+        String alias = socket==null?NO_MATCHERS:chooseServerAlias(keyType,issuers,sslSocket.getSSLParameters().getSNIMatchers(),sslSocket.getHandshakeSession());
         if (alias==NO_MATCHERS)
             alias=_delegate.chooseServerAlias(keyType,issuers,socket);
         if (LOG.isDebugEnabled())
@@ -123,7 +122,7 @@ public class SniX509ExtendedKeyManager extends X509ExtendedKeyManager
     @Override
     public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)
     {
-        String alias = chooseServerAlias(keyType,issuers,engine.getSSLParameters().getSNIMatchers(),engine.getHandshakeSession());
+        String alias = engine==null?NO_MATCHERS:chooseServerAlias(keyType,issuers,engine.getSSLParameters().getSNIMatchers(),engine.getHandshakeSession());
         if (alias==NO_MATCHERS)
             alias=_delegate.chooseEngineServerAlias(keyType,issuers,engine);
         if (LOG.isDebugEnabled())