diff --git a/install/share/kdc.conf.template b/install/share/kdc.conf.template
index 232fedc44..685d42f3b 100644
--- a/install/share/kdc.conf.template
+++ b/install/share/kdc.conf.template
@@ -6,7 +6,8 @@
 
 [realms]
  $REALM = {
-  master_key_type = aes256-cts
+  master_key_type = $MASTER_KEY_TYPE
+  supported_enctypes = $SUPPORTED_ENCTYPES
   max_life = 7d
   max_renewable_life = 14d
   acl_file = $KRB5KDC_KADM5_ACL
diff --git a/install/share/kerberos.ldif b/install/share/kerberos.ldif
index 3b75b4456..51e5cf9bc 100644
--- a/install/share/kerberos.ldif
+++ b/install/share/kerberos.ldif
@@ -28,6 +28,8 @@ ${FIPS}krbSupportedEncSaltTypes: camellia256-cts-cmac:normal
 ${FIPS}krbSupportedEncSaltTypes: camellia256-cts-cmac:special
 krbMaxTicketLife: 86400
 krbMaxRenewableAge: 604800
+krbDefaultEncSaltTypes: aes256-sha2:special
+krbDefaultEncSaltTypes: aes128-sha2:special
 krbDefaultEncSaltTypes: aes256-cts:special
 krbDefaultEncSaltTypes: aes128-cts:special
 
diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
index 216c1032d..852edcd99 100644
--- a/ipaserver/install/krbinstance.py
+++ b/ipaserver/install/krbinstance.py
@@ -51,6 +51,14 @@ logger = logging.getLogger(__name__)
 
 PKINIT_ENABLED = 'pkinitEnabled'
 
+MASTER_KEY_TYPE = 'aes256-sha1'
+SUPPORTED_ENCTYPES = ('aes256-sha2:special', 'aes128-sha2:special',
+                      'aes256-sha2:normal', 'aes128-sha2:normal',
+                      'aes256-cts:special', 'aes128-cts:special',
+                      'aes256-cts:normal', 'aes128-cts:normal',
+                      'camellia256-cts:special', 'camellia128-cts:special',
+                      'camellia256-cts:normal', 'camellia128-cts:normal')
+
 
 def get_pkinit_request_ca():
     """
@@ -252,6 +260,7 @@ class KrbInstance(service.Service):
         else:
             includes = ''
 
+        fips_enabled = tasks.is_fips_enabled()
         self.sub_dict = dict(FQDN=self.fqdn,
                              IP=self.ip,
                              PASSWORD=self.kdc_password,
@@ -269,7 +278,17 @@ class KrbInstance(service.Service):
                              KDC_CA_BUNDLE_PEM=paths.KDC_CA_BUNDLE_PEM,
                              CA_BUNDLE_PEM=paths.CA_BUNDLE_PEM,
                              INCLUDES=includes,
-                             FIPS='#' if tasks.is_fips_enabled() else '')
+                             FIPS='#' if fips_enabled else '')
+
+        if fips_enabled:
+            supported_enctypes = list(
+                filter(lambda e: not e.startswith('camelia'),
+                       SUPPORTED_ENCTYPES))
+        else:
+            supported_enctypes = SUPPORTED_ENCTYPES
+        self.sub_dict['SUPPORTED_ENCTYPES'] = ' '.join(supported_enctypes)
+
+        self.sub_dict['MASTER_KEY_TYPE'] = MASTER_KEY_TYPE
 
         # IPA server/KDC is not a subdomain of default domain
         # Proper domain-realm mapping needs to be specified