eMudhra shares slumped 20% on the Bombay Stock Exchange on Thursday after the Bengaluru-based digital trust firm admitted a critical security lapse. The company acknowledged that a cryptographic flaw generated weak private keys linked to eight intermediate digital certificates in its global website-certificate business. Attackers could potentially use these flaws to impersonate legitimate websites, a threat that spooked investors immediately.
The incident traces back to a key-generation ceremony on April 30, 2025. During this process, a second set of weak keys was inadvertently generated alongside the original strong ones. Dennis Jackson, a cryptography engineer at Mozilla, flagged the issue on October 17, citing insufficient randomness that made the keys vulnerable to recovery. eMudhra is currently investigating the root cause of this generation error.
Financially, the damage appears contained but the reputational hit is significant. The affected Transport Layer Security (TLS) business accounts for only about 1% of the company’s revenue. For FY26, eMudhra reported revenue of roughly ₹710 crore and EBITDA of approximately ₹110 crore. The firm had previously guided for 15–18% revenue growth, focusing on higher-margin enterprise solutions.
Co-founder Kaushik Srinivasan told The Times of India that no certificates had been issued from the affected root in India. Only one US customer had received certificates under the affected infrastructure. He stressed that the company’s infrastructure had not been breached, and its Indian digital signature certificate (DSC), eSign, and enterprise solutions businesses remained completely unaffected.
Regulators are moving fast. The Ministry of Electronics and Information Technology has constituted a special team to investigate the matter. An official stated that the impact on Indian websites and applications was "very limited and for a very short interval," emphasizing that DSC and eSign services regulated by the Controller of Certifying Authorities were untouched. Meanwhile, Mozilla blocked six affected certificates and released Firefox security updates, while Google blocked the affected public keys for Android devices. CERT-In warned organizations to install the latest patches to prevent website impersonation and fraudulent code-signing.