eMudhra shares crash another 4%, down 40% in 3 sessions. What’s behind this free fall?
Chairman V. Srinivasan said the company handled the recent incident involving its global SSL/TLS certificate business diligently, revoking the affected certificate authorities (CAs) within 14 hours of discovery and making a prompt disclosure. No end-entity certificates had been issued by the affected CAs, and the company said its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.
Srinivasan said the global SSL/TLS business contributes about 1% of eMudhra’s global revenue. He added that rising data sovereignty and compliance requirements have increased the complexity and cost of operating in the segment, while the availability of free SSL/TLS certificates from some large entities has reduced its business potential and return on investment relative to the company’s overall revenue base.
The company said the incident had attracted social media attention and scrutiny disproportionate to the segment’s contribution to its business. Following detailed deliberations, the board concluded that exiting the global SSL/TLS certificate business was the right decision for eMudhra and its shareholders.
eMudhra shares
Earlier this week, the Indian Computer Emergency Response Team (CERT-In), the Centre’s nodal cybersecurity agency, issued an urgent advisory following a critical security incident involving eMudhra. The company reported a compromise of private keys linked to eight intermediate Certificate Authority (CA) certificates.
Also read: Ola Electric shares dip 5% after Goldman Sachs downgrades stock to Sell. Here’s why
In a series of posts on X, the Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the incident and was working with stakeholders to address the issue. It added that eMudhra’s Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY, remain unaffected.“The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said. MeitY said eMudhra operates across two distinct businesses. One covers digital signature and eSign services regulated by the CCA, while the other provides digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.
The eight affected certificates were issued under eMudhra’s global Public Key Infrastructure (PKI), which establishes trust in digital certificates and secures online connections.
eMudhra’s response
“A flaw in the Key Generation Ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause,” it said in a regulatory filing.
These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025. Last weekend, an independent researcher found that the weak keys could be reverse-engineered, possibly with AI-assisted techniques. The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla.
However, the company said the incident could pose reputational risks, the extent of which cannot be quantified. “eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation,” it added.
Disclaimer: This article has been written by Veer Sharma, who is not a SEBI-registered Research Analyst or an Investment Adviser. Veer Sharma and his/her ‘relative(s)’ (as defined under Section 2(77) of the Companies Act, 2013) do not hold any financial interest in the companies mentioned in this article as of the date of publication. The views/recommendations mentioned in this article, wherever applicable, are those of the respective SEBI-registered Research Analyst/brokerage and have been reproduced/reported with due attribution. They should not be construed as the views or recommendations of The Economic Times Digital or the journalist. Readers are advised to consider the original research report and make their investment decisions based on their own assessment. Brokerage disclaimers here.
