[dxbjavid]

SpkiPinningClientTlsStrategy matches pin rules against the host exactly as given, so a request to https://api.example.com./ yields api.example.com. and no rule applies, while the default built-in hostname check still accepts it because the JDK drops the root dot from SNI. In practice any CA-trusted certificate for a pinned host appears to be accepted whenever the URL is spelt in its absolute form (for instance after a redirect), which rather defeats the pinning; against a local TLS server with a non-matching pin the plain host is rejected while the dotted one returns 200. The patch strips a single trailing dot from both the request host and the configured patterns before matching, with a regression test covering the exact and wildcard cases.