diff --git a/quic/core/crypto/proof_source.h b/quic/core/crypto/proof_source.h
index 830ce2b..3bae221 100644
--- a/quic/core/crypto/proof_source.h
+++ b/quic/core/crypto/proof_source.h
@@ -283,6 +283,9 @@
   // Starts a select certificate operation. If the operation is not cancelled
   // when it completes, callback()->OnSelectCertificateDone will be invoked.
   //
+  // server_address and client_address should be normalized by the caller before
+  // sending down to this function.
+  //
   // If the operation is handled synchronously:
   // - QUIC_SUCCESS or QUIC_FAILURE will be returned.
   // - callback()->OnSelectCertificateDone should be invoked before the function
diff --git a/quic/core/tls_server_handshaker.cc b/quic/core/tls_server_handshaker.cc
index 01e1db2..db7202e 100644
--- a/quic/core/tls_server_handshaker.cc
+++ b/quic/core/tls_server_handshaker.cc
@@ -849,9 +849,9 @@
           : std::string();
 
   const QuicAsyncStatus status = proof_source_handle_->SelectCertificate(
-      session()->connection()->self_address(),
-      session()->connection()->peer_address(), ssl_capabilities_view,
-      crypto_negotiated_params_->sni,
+      session()->connection()->self_address().Normalized(),
+      session()->connection()->peer_address().Normalized(),
+      ssl_capabilities_view, crypto_negotiated_params_->sni,
       absl::string_view(
           reinterpret_cast<const char*>(client_hello->client_hello),
           client_hello->client_hello_len),