diff --git a/lib/manageiq/appliance_console/principal.rb b/lib/manageiq/appliance_console/principal.rb
index 06fce395..e03d2796 100644
--- a/lib/manageiq/appliance_console/principal.rb
+++ b/lib/manageiq/appliance_console/principal.rb
@@ -15,7 +15,7 @@ def initialize(options = {})
       options.each { |n, v| public_send("#{n}=", v) }
       @ca_name ||= "ipa"
       @realm = @realm.upcase if @realm
-      @name ||= "#{service}/#{hostname}@#{realm}"
+      @name ||= "#{service}/#{hostname}\\@#{realm}"
     end
 
     def register
diff --git a/spec/certificate_spec.rb b/spec/certificate_spec.rb
index c280a674..427819c5 100644
--- a/spec/certificate_spec.rb
+++ b/spec/certificate_spec.rb
@@ -23,7 +23,7 @@
 
   # not sure if we care about this (it is probably allowing us to neglect )
   it "should have a principal" do
-    expect(subject.principal.name).to eq("postgres/#{host}@#{realm}")
+    expect(subject.principal.name).to eq("postgres/#{host}\\@#{realm}")
     expect(subject.principal).to be_ipa
   end
 
diff --git a/spec/principal_spec.rb b/spec/principal_spec.rb
index 905e712b..3aef9d4d 100644
--- a/spec/principal_spec.rb
+++ b/spec/principal_spec.rb
@@ -3,7 +3,7 @@
   let(:hostname) { "machine.network.com" }
   let(:realm)    { "NETWORK.COM" }
   let(:service)  { "postgres" }
-  let(:principal_name) { "postgres/machine.network.com@NETWORK.COM" }
+  let(:principal_name) { "postgres/machine.network.com\\@NETWORK.COM" }
 
   subject { described_class.new(:hostname => hostname, :realm => realm, :service => service) }