diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,9 @@
+# Changelog for http-client-tls
+
+## 0.3.6
+
+* Allow making requests to raw IPv6 hosts [#477](https://github.com/snoyberg/http-client/pull/477)
+
 ## 0.3.5.3
 
 * Fix `newTlsManager` [#325](https://github.com/snoyberg/http-client/issues/325)
diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -121,7 +121,7 @@
     context <- maybe NC.initConnectionContext return mcontext
     return $ \_ha host port -> bracketOnError
         (NC.connectTo context NC.ConnectionParams
-            { NC.connectionHostname = host
+            { NC.connectionHostname = strippedHostName host
             , NC.connectionPort = fromIntegral port
             , NC.connectionUseSecure = tls
             , NC.connectionUseSocks = sock
@@ -138,13 +138,13 @@
     context <- maybe NC.initConnectionContext return mcontext
     return $ \connstr checkConn serverName _ha host port -> bracketOnError
         (NC.connectTo context NC.ConnectionParams
-            { NC.connectionHostname = serverName
+            { NC.connectionHostname = strippedHostName serverName
             , NC.connectionPort = fromIntegral port
             , NC.connectionUseSecure = Nothing
             , NC.connectionUseSocks =
                 case sock of
                     Just _ -> error "Cannot use SOCKS and TLS proxying together"
-                    Nothing -> Just $ NC.OtherProxy host $ fromIntegral port
+                    Nothing -> Just $ NC.OtherProxy (strippedHostName host) $ fromIntegral port
             })
         NC.connectionClose
         $ \conn -> do
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.5.3
+version:             0.3.6
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client
@@ -16,7 +16,7 @@
 library
   exposed-modules:     Network.HTTP.Client.TLS
   other-extensions:    ScopedTypeVariables
-  build-depends:       base >= 4 && < 5
+  build-depends:       base >= 4.10 && < 5
                      , data-default-class
                      , http-client >= 0.5.0
                      , connection >= 0.2.5
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -29,6 +29,26 @@
             `shouldThrow` \(DigestAuthException _ _ det) ->
                 det == UnexpectedStatusCode
 
+    it "BadSSL: expired" $ do
+        manager <- newManager tlsManagerSettings
+        let action = withResponse "https://expired.badssl.com/" manager (const (return ()))
+        action `shouldThrow` anyException
+
+    it "BadSSL: self-signed" $ do
+        manager <- newManager tlsManagerSettings
+        let action = withResponse "https://self-signed.badssl.com/" manager (const (return ()))
+        action `shouldThrow` anyException
+
+    it "BadSSL: wrong.host" $ do
+        manager <- newManager tlsManagerSettings
+        let action = withResponse "https://wrong.host.badssl.com/" manager (const (return ()))
+        action `shouldThrow` anyException
+
+    it "BadSSL: we do have case-insensitivity though" $ do
+        manager <- newManager $ tlsManagerSettings
+        withResponse "https://BADSSL.COM" manager $ \res ->
+            responseStatus res `shouldBe` status200
+
     -- https://github.com/snoyberg/http-client/issues/289
     it "accepts TLS settings" $ do
         let