diff --git a/src/share/classes/sun/security/krb5/PrincipalName.java b/src/share/classes/sun/security/krb5/PrincipalName.java
index 885e13cad1efd1a4c8ea3b3d1b1b8bd14b6fc886..6d5ed3dde67108af35824791df65be7a0ea373df 100644
--- a/src/share/classes/sun/security/krb5/PrincipalName.java
+++ b/src/share/classes/sun/security/krb5/PrincipalName.java
@@ -424,6 +424,9 @@ public class PrincipalName implements Cloneable {
                 } catch (UnknownHostException | SecurityException e) {
                     // not canonicalized or no permission to do so, use old
                 }
+                if (hostName.endsWith(".")) {
+                    hostName = hostName.substring(0, hostName.length() - 1);
+                }
                 nameParts[1] = hostName.toLowerCase(Locale.ENGLISH);
             }
             nameStrings = nameParts;
diff --git a/test/sun/security/krb5/canonicalize/Test.java b/test/sun/security/krb5/canonicalize/Test.java
index 9340163fbb467d3b0fb218fb6ecb8363af999291..3bd0bac55b16a166b37097b3fb50881cdcd9e710 100644
--- a/test/sun/security/krb5/canonicalize/Test.java
+++ b/test/sun/security/krb5/canonicalize/Test.java
@@ -22,7 +22,7 @@
  */
 /*
  * @test
- * @bug 6682516
+ * @bug 6682516 8149521
  * @summary SPNEGO_HTTP_AUTH/WWW_KRB and SPNEGO_HTTP_AUTH/WWW_SPNEGO failed on all non-windows platforms
  * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock -Djava.security.krb5.conf=krb5.conf Test
  */
@@ -43,9 +43,11 @@ public class Test implements NameServiceDescriptor {
         check("c1", "c1.this.domain");
         check("c1.this", "c1.this.domain");
         check("c1.this.domain", "c1.this.domain");
+        check("c1.this.domain.", "c1.this.domain");
 
         // canonicalized name goes IP, reject
         check("c2", "c2");
+        check("c2.", "c2");
 
         // canonicalized name goes strange, reject
         check("c3", "c3");