CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot

MariaDB Connector/J 3.5.7 introduced explicit TLS SNI support under CONJ-1282.
When the JDBC hostname is an absolute FQDN ending with a trailing dot, for example:

mariadb.database.svc.cluster.local.

the driver passes the hostname directly to:

new SNIHostName(hostAddress.host)

Java rejects an SNI hostname ending with a trailing dot and throws:

java.lang.IllegalArgumentException:

Server name value of host_name cannot have the trailing dot

The trailing dot is valid DNS syntax and represents an absolute fully qualified domain name. It is commonly used in Kubernetes environments to prevent DNS search-domain expansion.

Reproduction

Fails:

jdbc:mariadb://mariadb.database.svc.cluster.local.:3306/keycloak?sslMode=verify-full

Works:

jdbc:mariadb://mariadb.database.svc.cluster.local:3306/keycloak?sslMode=verify-full

The configuration worked with MariaDB Connector/J 3.5.6 and started failing after upgrading to 3.5.7.

Expected behaviour

Connector/J should retain the original hostname for DNS resolution but remove exactly one terminal dot before using the hostname for:

• TLS SNI
• Certificate hostname verification

For example:

DNS/socket host: mariadb.database.svc.cluster.local.

TLS SNI host:    mariadb.database.svc.cluster.local

Optionally, Connector/J could provide a tlsServerName property for cases where the network endpoint hostname and TLS identity are different.

Comparision with OpenJDK default implementation

OpenJDK's TLS implementation checks whether the host ends with . and removes it because a terminal dot is not permitted in SNIHostName. It then creates the SNI name from the normalized value.

Relevant upstream logic:

private static SNIHostName rawToSNIHostName(String hostname) {

       //........

       if (hostname != null && hostname.endsWith(".")) {

            hostname = hostname.substring(0, hostname.length() - 1);

       }

}