ICRA maintained eMudhra’s A/A1 credit rating on a ₹35 crore unallocated credit limit after a flaw in its certificate key generation caused browser makers to block eight intermediate authorities—forcing the company to revoke the affected certificates.
The exit of the global SSL/TLS certificate business, which contributes about 1% of consolidated revenue, is unlikely to dent overall earnings; yet the ripple effect could hit the core enterprise solutions arm that accounts for 64% of revenue, especially in overseas markets.
Regulatory uncertainty looms as investigators probe whether the weak keys were misused in the past, raising the risk of third‑party claims and reputational damage. Despite this, ICRA highlighted eMudhra’s net debt‑free stance and robust liquidity as a cushion against near‑term disruption.
Kaushik Srinivasan, co‑founder, dismissed the lapse as a “one‑off incident on a bad day,” assuring stakeholders that no data was breached and that the company’s Digital Signature Certificate and eSign businesses remain untouched.
ICRA will keep monitoring the regulatory review, eMudhra’s order inflows, and business momentum in the next quarters, while the market watches how the company’s shift away from certificate issuance will play out on the NSE.