eMudhra shares closed at ₹432 on October 21 and opened at ₹346 on October 29, a 20% decline that rattled the market after the company revealed weak private keys tied to eight intermediate certificates.
The incident, first flagged by researcher Wayne on October 17, exposed keys with only 3‑8 bits of entropy, making them susceptible to instant recovery. The breach prompted urgent advisory from the Indian Computer Emergency Response Team and a swift revocation of the eight compromised authorities within 14 hours.
In a Friday briefing, the company said it had hired KPMG to conduct an independent review of the incident, a move aimed at quelling investor unease and satisfying regulatory scrutiny. The engagement follows earlier warnings from major tech firms, Google and Mozilla, who blocked the affected certificates to protect users.
On October 22, eMudhra’s board announced its decision to exit the global SSL/TLS certificate business, citing a 1% contribution to revenue and the rise of free alternatives. Chairman V Srinivasan stressed that no end‑entity certificates were issued through the compromised authorities and no data was lost.
The announcement comes amid calls from former CERT‑In director‑general Gulshan Rai for a full audit of the company’s Indian operations, potentially leading to a license suspension. Meanwhile, the Ministry of Electronics and Information Technology has formed a special team to investigate the breach.
Looking ahead, the company has committed to supplying replacement certificates at no cost to affected customers, while KPMG’s findings will shape any remedial measures. Investors will watch closely for the next earnings release to gauge whether the security scandal will materially affect revenue growth or if the company’s strategic exit will offset the hit.