diff --git a/security/openconnect/Makefile b/security/openconnect/Makefile
index f313dc9ed..e922426b2 100644
--- a/security/openconnect/Makefile
+++ b/security/openconnect/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		openconnect
-PLUGIN_VERSION=		1.3.3
+PLUGIN_VERSION=		1.4.0
 PLUGIN_COMMENT=		OpenConnect Client
 PLUGIN_DEPENDS=		openconnect
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/security/openconnect/pkg-descr b/security/openconnect/pkg-descr
index 6338929ed..cba5a5c27 100644
--- a/security/openconnect/pkg-descr
+++ b/security/openconnect/pkg-descr
@@ -6,6 +6,10 @@ the Juniper SSL VPN which is now known as Pulse Connect Secure.
 Plugin Changelog
 ================
 
+1.4.0
+
+* Add "pin-sha256" certificate hash
+
 1.3.3
 
 * Enhance allowed characters in group name
diff --git a/security/openconnect/src/opnsense/mvc/app/models/OPNsense/Openconnect/General.xml b/security/openconnect/src/opnsense/mvc/app/models/OPNsense/Openconnect/General.xml
index a698445cd..73924acf6 100644
--- a/security/openconnect/src/opnsense/mvc/app/models/OPNsense/Openconnect/General.xml
+++ b/security/openconnect/src/opnsense/mvc/app/models/OPNsense/Openconnect/General.xml
@@ -25,7 +25,7 @@
         </password>
         <servercert type="TextField">
             <Required>N</Required>
-            <mask>/^[a-z0-9]{40,64}$/</mask>
+            <mask>/^([a-zA-Z0-9\/\+\=]){40,64}$/u</mask>
             <ValidationMessage>Please provide a valid hash.</ValidationMessage>
         </servercert>
         <hash type="OptionField">
@@ -35,6 +35,7 @@
                 <OptionValues>
                     <sha256>SHA256</sha256>
                     <sha1>SHA1</sha1>
+                    <pin-sha256>PIN-SHA256</pin-sha256>
                 </OptionValues>
         </hash>
         <group type="TextField">