diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
index ec239e9019c..9e809000b9d 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
@@ -36,6 +36,7 @@
 import org.apache.wss4j.policy.SP11Constants;
 import org.apache.wss4j.policy.SP12Constants;
 import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.xml.security.algorithms.JCEMapper;
 
 /**
  *
@@ -79,8 +80,10 @@ static String setupClient(STSClient client, SoapMessage message, AssertionInfoMa
         AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim);
         if (suite != null) {
             client.setAlgorithmSuite(suite);
-            int x = suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength();
-            if (x < 256) {
+            // The secret must have exactly the length required by the encryption algorithm of the suite
+            int x = JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption());
+            if (x >= suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength()
+                && x <= suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) {
                 client.setKeySize(x);
             }
         }