--- a/src/ssl.c
+++ b/src/ssl.c
@@ -138,7 +138,7 @@
     }
 
     /* set current working directory */
-#ifndef _WIN32_WCE
+#if !defined(_WIN32_WCE) && !defined(CRYPTNODE_PRESERVE_CWD)
     if(!SetCurrentDirectory(stunnel_exe_path)) {
         LPTSTR errmsg=str_tprintf(TEXT("Cannot set directory to %s"),
             stunnel_exe_path);
--- a/src/verify.c
+++ b/src/verify.c
@@ -306,6 +306,30 @@
     }
 #endif /* !defined(OPENSSL_NO_OCSP) */
 
+#ifdef CRYPTNODE_PEER_PIN
+    /* A private CryptNode client process has exactly one Profile pin. */
+    if(c->opt->option.client && depth==0) {
+        const char *pin=getenv("CRYPTNODE_PEER_SHA256");
+        unsigned char digest[EVP_MAX_MD_SIZE];
+        unsigned int length=0, i;
+        static const char hex[]="0123456789abcdef";
+        int matches=pin && strlen(pin)==64;
+        if(matches && X509_digest(cert, EVP_sha256(), digest, &length) && length==32) {
+            for(i=0; i<32; ++i)
+                if(pin[2*i]!=hex[digest[i]>>4] || pin[2*i+1]!=hex[digest[i]&15])
+                    matches=0;
+        } else {
+            matches=0;
+        }
+        if(!matches) {
+            s_log(LOG_ERR, "CRYPTNODE: leaf DER SHA256 pin rejected");
+            X509_STORE_CTX_set_error(callback_ctx, X509_V_ERR_APPLICATION_VERIFICATION);
+            str_free(subject);
+            return 0;
+        }
+    }
+#endif /* CRYPTNODE_PEER_PIN */
+
     s_log(depth ? LOG_INFO : LOG_NOTICE,
         "Certificate accepted at depth=%d: %s", depth, subject);
     str_free(subject);
