diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 521315b3621..b9f8787bcfe 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -461,6 +461,9 @@ Release 2.8.0 - UNRELEASED
     HDFS-8218. Move classes that used by ClientProtocol into hdfs-client.
     (wheat9)
 
+    HDFS-4448. Allow HA NN to start in secure mode with wildcard address
+    configured (atm via asuresh)
+
   OPTIMIZATIONS
 
     HDFS-8026. Trace FSOutputSummer#writeChecksumChunks rather than
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DFSUtil.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DFSUtil.java
index 60a496fa48c..078b0bb52eb 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DFSUtil.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/DFSUtil.java
@@ -1017,17 +1017,10 @@ public class DFSUtil {
    */
   @VisibleForTesting
   static String substituteForWildcardAddress(String configuredAddress,
-    String defaultHost) throws IOException {
+    String defaultHost) {
     InetSocketAddress sockAddr = NetUtils.createSocketAddr(configuredAddress);
-    InetSocketAddress defaultSockAddr = NetUtils.createSocketAddr(defaultHost
-        + ":0");
     final InetAddress addr = sockAddr.getAddress();
     if (addr != null && addr.isAnyLocalAddress()) {
-      if (UserGroupInformation.isSecurityEnabled() &&
-          defaultSockAddr.getAddress().isAnyLocalAddress()) {
-        throw new IOException("Cannot use a wildcard address with security. " +
-            "Must explicitly set bind address for Kerberos");
-      }
       return defaultHost + ":" + sockAddr.getPort();
     } else {
       return configuredAddress;