ipa-getkeytab fails

[Dmitry Krasov]

Hello.
Centos 9 client
Trying get new keytab from ipa (ubuntu), by this command (after kinit):

ipa-getkeytab -s ipa.dom.loc -p host/clienthost.l3874.ru -k /etc/krb5.keytab
Failed to get key table file

"update-crypto-policies --set DEFAULT:AD-SUPPORT-LEGACY" doesn't help

On ubuntu clients " ipa-getkeytab --permitted-enctypes" shows:

AES-256 CTS mode with 96-bit SHA-1 HMAC
AES-128 CTS mode with 96-bit SHA-1 HMAC
AES-256 CTS mode with 192-bit SHA-384 HMAC
AES-128 CTS mode with 128-bit SHA-256 HMAC
Triple DES cbc mode with HMAC/sha1
ArcFour with HMAC/md5
Camellia-128 CTS mode with CMAC
Camellia-256 CTS mode with CMAC

But on Centos 9 are AES types only.
How can I add other 4 types?