diff --git a/src/java.net.http/share/classes/jdk/internal/net/http/common/Utils.java b/src/java.net.http/share/classes/jdk/internal/net/http/common/Utils.java

--- a/src/java.net.http/share/classes/jdk/internal/net/http/common/Utils.java

+++ b/src/java.net.http/share/classes/jdk/internal/net/http/common/Utils.java

@@ -157,6 +157,7 @@

                 return true;

             };

+    private static final Predicate<String> IS_HOST = "host"::equalsIgnoreCase;

     private static final Predicate<String> IS_PROXY_HEADER = (k) ->

             k != null && k.length() > 6 && "proxy-".equalsIgnoreCase(k.substring(0,6));

     private static final Predicate<String> NO_PROXY_HEADER =

@@ -228,7 +229,8 @@

     public static final BiPredicate<String, String> PROXY_TUNNEL_FILTER =

             (s,v) -> isAllowedForProxy(s, v, PROXY_AUTH_TUNNEL_DISABLED_SCHEMES,

-                    IS_PROXY_HEADER);

+                    // Allows Proxy-* and Host headers when establishing the tunnel.

+                    IS_PROXY_HEADER.or(IS_HOST));

     public static final BiPredicate<String, String> PROXY_FILTER =

             (s,v) -> isAllowedForProxy(s, v, PROXY_AUTH_DISABLED_SCHEMES,

                     ALL_HEADERS);

diff --git a/test/jdk/java/net/httpclient/DigestEchoServer.java b/test/jdk/java/net/httpclient/DigestEchoServer.java

--- a/test/jdk/java/net/httpclient/DigestEchoServer.java

+++ b/test/jdk/java/net/httpclient/DigestEchoServer.java

@@ -82,6 +82,8 @@

             Boolean.parseBoolean(System.getProperty("test.debug", "false"));

     public static final boolean NO_LINGER =

             Boolean.parseBoolean(System.getProperty("test.nolinger", "false"));

+    public static final boolean TUNNEL_REQUIRES_HOST =

+            Boolean.parseBoolean(System.getProperty("test.requiresHost", "false"));

     public enum HttpAuthType {

         SERVER, PROXY, SERVER307, PROXY305

         /* add PROXY_AND_SERVER and SERVER_PROXY_NONE */

@@ -1524,6 +1526,36 @@

             }

         }

+        boolean badRequest(StringBuilder response, String hostport, List<String> hosts) {

+            String message = null;

+            if (hosts.isEmpty()) {

+                message = "No host header provided\r\n";

+            } else if (hosts.size() > 1) {

+                message = "Multiple host headers provided\r\n";

+                for (String h : hosts) {

+                    message = message + "host: " + h + "\r\n";

+                }

+            } else {

+                String h = hosts.get(0);

+                if (!hostport.equalsIgnoreCase(h)

+                        && !hostport.equalsIgnoreCase(h + ":80")

+                        && !hostport.equalsIgnoreCase(h + ":443")) {

+                    message = "Bad host provided: [" + h

+                            + "] doesnot match [" + hostport + "]\r\n";

+                }

+            }

+            if (message != null) {

+                int length = message.getBytes(StandardCharsets.UTF_8).length;

+                response.append("HTTP/1.1 400 BadRequest\r\n")

+                        .append("Content-Length: " + length)

+                        .append("\r\n\r\n")

+                        .append(message);

+                return true;

+            }

+

+            return false;

+        }

+

         boolean authorize(StringBuilder response, String requestLine, String headers) {

             if (authorization != null) {

                 return authorization.authorize(response, requestLine, headers);

@@ -1637,6 +1669,7 @@

                         assert connect.equalsIgnoreCase("connect");

                         String hostport = tokenizer.nextToken();

                         InetSocketAddress targetAddress;

+                        List<String> hosts = new ArrayList<>();

                         try {

                             URI uri = new URI("https", hostport, "/", null, null);

                             int port = uri.getPort();

@@ -1661,9 +1694,30 @@

                             System.out.println(now() + "Tunnel: Reading header: "

                                                + (line = readLine(ccis)));

                             headers.append(line).append("\r\n");

+                            int index = line.indexOf(':');

+                            if (index >= 0) {

+                                String key = line.substring(0, index).trim();

+                                if (key.equalsIgnoreCase("host")) {

+                                    hosts.add(line.substring(index+1).trim());

+                                }

+                            }

+                        }

+                        StringBuilder response = new StringBuilder();

+                        if (TUNNEL_REQUIRES_HOST) {

+                            if (badRequest(response, hostport, hosts)) {

+                                System.out.println(now() + "Tunnel: Sending " + response);

+                                // send the 400 response

+                                pw.print(response.toString());

+                                pw.flush();

+                                toClose.close();

+                                continue;

+                            } else {

+                                assert hosts.size() == 1;

+                                System.out.println(now()

+                                        + "Tunnel: Host header verified " + hosts);

+                            }

                         }

-                        StringBuilder response = new StringBuilder();

                         final boolean authorize = authorize(response, requestLine, headers.toString());

                         if (!authorize) {

                             System.out.println(now() + "Tunnel: Sending "

diff --git a/test/jdk/java/net/httpclient/HttpsTunnelTest.java b/test/jdk/java/net/httpclient/HttpsTunnelTest.java

--- a/test/jdk/java/net/httpclient/HttpsTunnelTest.java

+++ b/test/jdk/java/net/httpclient/HttpsTunnelTest.java

@@ -1,5 +1,5 @@

 /*

- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

+ * Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

@@ -47,8 +47,9 @@

  *          proxy P is downgraded to HTTP/1.1, then a new h2 request

  *          going to a different host through the same proxy will not

  *          be preemptively downgraded. That, is the stack should attempt

- *          a new h2 connection to the new host.

- * @bug 8196967

+ *          a new h2 connection to the new host. It also verifies that

+ *          the stack sends the appropriate "host" header to the proxy.

+ * @bug 8196967 8222527

  * @library /lib/testlibrary http2/server

  * @build jdk.testlibrary.SimpleSSLContext HttpServerAdapters DigestEchoServer HttpsTunnelTest

  * @modules java.net.http/jdk.internal.net.http.common

@@ -58,7 +59,10 @@

  *          java.base/sun.net.www.http

  *          java.base/sun.net.www

  *          java.base/sun.net

- * @run main/othervm -Djdk.internal.httpclient.debug=true HttpsTunnelTest

+ * @run main/othervm -Dtest.requiresHost=true

+ *                   -Djdk.httpclient.HttpClient.log=headers

+ *                   -Djdk.internal.httpclient.debug=true HttpsTunnelTest

+ *

  */

 public class HttpsTunnelTest implements HttpServerAdapters {

@@ -145,6 +149,7 @@

             if (!lines.equals(respLines)) {

                 throw new RuntimeException("Unexpected response 1: " + respLines);

             }

+

             HttpRequest.BodyPublisher reqBody2 = HttpRequest.BodyPublishers.ofString(body);

             HttpRequest req2 = HttpRequest

                     .newBuilder(uri2)

diff --git a/test/jdk/java/net/httpclient/ProxyAuthDisabledSchemesSSL.java b/test/jdk/java/net/httpclient/ProxyAuthDisabledSchemesSSL.java

--- a/test/jdk/java/net/httpclient/ProxyAuthDisabledSchemesSSL.java

+++ b/test/jdk/java/net/httpclient/ProxyAuthDisabledSchemesSSL.java

@@ -1,5 +1,5 @@

 /*

- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

+ * Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

@@ -23,7 +23,7 @@

 /**

  * @test

- * @bug 8087112

+ * @bug 8087112 8222527

  * @summary this test verifies that a client may provides authorization

  *          headers directly when connecting with a server over SSL, and

  *          it verifies that the client honor the jdk.http.auth.*.disabledSchemes

@@ -43,9 +43,11 @@

  *                   ProxyAuthDisabledSchemesSSL SSL

  * @run main/othervm -Djdk.http.auth.proxying.disabledSchemes=Basic

  *                   -Djdk.http.auth.tunneling.disabledSchemes=Basic

+ *                   -Dtest.requiresHost=true

  *                   ProxyAuthDisabledSchemesSSL SSL PROXY

  * @run main/othervm -Djdk.http.auth.proxying.disabledSchemes=Digest

  *                   -Djdk.http.auth.tunneling.disabledSchemes=Digest

+ *                   -Dtest.requiresHost=true

  *                   ProxyAuthDisabledSchemesSSL SSL PROXY

  */