diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c
index 046cdb05d369..635402d9f24c 100644
--- a/core/sme/src/csr/csr_util.c
+++ b/core/sme/src/csr/csr_util.c
@@ -2812,9 +2812,22 @@ uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId,
 	uint8_t *rsn_ie_end = NULL;
 	uint8_t *rsn_ie = (uint8_t *)pRSNIe;
 	uint8_t ie_len = 0;
+	tDot11fBeaconIEs *local_ap_ie = ap_ie;
+	uint16_t rsn_cap = 0, self_rsn_cap;
 	struct wlan_crypto_pmksa pmksa, *pmksa_peer;
 	struct csr_roam_session *session = &mac->roam.roamSession[sessionId];
 
+	if (!local_ap_ie &&
+	    (!QDF_IS_STATUS_SUCCESS(csr_get_parsed_bss_description_ies
+	     (mac, pSirBssDesc, &local_ap_ie))))
+		return ie_len;
+
+	/* get AP RSN cap */
+	qdf_mem_copy(&rsn_cap, local_ap_ie->RSN.RSN_Cap, sizeof(rsn_cap));
+	if (!ap_ie && local_ap_ie)
+		/* locally allocated */
+		qdf_mem_free(local_ap_ie);
+
 	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(mac->psoc, sessionId,
 						    WLAN_LEGACY_SME_ID);
 	if (!vdev) {
@@ -2822,6 +2835,20 @@ uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId,
 		return ie_len;
 	}
 
+	self_rsn_cap = (uint16_t)wlan_crypto_get_param(vdev,
+						   WLAN_CRYPTO_PARAM_RSN_CAP);
+	/* If AP is capable then use self capability else set PMF as 0 */
+	if (rsn_cap & WLAN_CRYPTO_RSN_CAP_MFP_ENABLED &&
+	    pProfile->MFPCapable) {
+		self_rsn_cap |= WLAN_CRYPTO_RSN_CAP_MFP_ENABLED;
+		if (pProfile->MFPRequired)
+			self_rsn_cap |= WLAN_CRYPTO_RSN_CAP_MFP_REQUIRED;
+	} else {
+		self_rsn_cap &= ~WLAN_CRYPTO_RSN_CAP_MFP_ENABLED;
+		self_rsn_cap &= ~WLAN_CRYPTO_RSN_CAP_MFP_REQUIRED;
+	}
+	wlan_crypto_set_vdev_param(vdev, WLAN_CRYPTO_PARAM_RSN_CAP,
+				   self_rsn_cap);
 	qdf_mem_zero(&pmksa, sizeof(pmksa));
 	if (pSirBssDesc->fils_info_element.is_cache_id_present) {
 		pmksa.ssid_len =