diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
index fec85315..fc913d6b 100644
--- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
+++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
@@ -615,6 +615,18 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 		this.addInclusivePrefixes = addInclusivePrefixes;
 	}
 
+	/**
+	 * Set whether to use a single certificate or a whole certificate chain when
+	 * constructing a {@code BinarySecurityToken} used for direct reference in signature.
+	 * default is {@code true}, meaning that only a single certificate is used.
+	 * @param useSingleCertificate whether to use a single certificate
+	 * @since 4.1.0
+	 * @see WSHandlerConstants#USE_SINGLE_CERTIFICATE
+	 */
+	public void setUseSingleCertificate(boolean useSingleCertificate) {
+		this.handler.setOption(WSHandlerConstants.USE_SINGLE_CERTIFICATE, useSingleCertificate);
+	}
+
 	/**
 	 * Sets whether the RSA 1.5 key transport algorithm is allowed.
 	 */