eMudhra shares plunge 20% after security flaw sparks global action

Bengaluru: Following a 20% crash in eMudhra shares on Wednesday, a flaw in the generation of private keys linked to eight intermediate digital certificates has triggered a global security response, with Mozilla, Google and Cloudflare taking steps to prevent attackers from impersonating legitimate websites.The compromised keys could potentially allow attackers to create fake security certificates for websites they do not own, making fraudulent sites appear genuine to browsers and exposing users to the risk of intercepted or altered communications.The issue was reported on Oct 17 by Dennis Jackson, a member of Mozilla’s cryptography engineering team, who flagged weaknesses in the keys associated with the eight eMudhra intermediate certificates. The keys had been generated with insufficient randomness, making them vulnerable to recovery.In an update on Wednesday, eMudhra said a flaw during a key-generation ceremony on April 30 last year resulted in a second set of weak keys being generated alongside the original strong keys. The weak keys were subsequently published to browser root stores. The company is investigating the root cause.Private keys are secret digital codes used to sign security certificates. These certificates work like identity documents for websites, allowing browsers to check whether a site is genuine. If the keys used to sign certificates are weak or recoverable, attackers could potentially create fraudulent certificates and make fake websites appear trustworthy.The affected certificates were part of eMudhra’s global transport layer security (TLS) business. The certificates had also undergone independent audits for two consecutive years and had been included in browser trust lists since mid-2025.Mozilla blocked six affected website-security certificates in Firefox through OneCRL, its centralised list of revoked certificates. It also released security updates for Firefox desktop, Android and extended-support versions, and removed the relevant root certificate from its trust store.Google blocked the affected public keys through its Certificate Revocation List Set, while similar protection was rolled out to supported Android devices through Google Play services. Cloudflare has also introduced security measures across services that rely on certificate verification.Kaushik Srinivasan, co-founder of eMudhra, told TOI that the incident did not involve a breach of the company’s infrastructure or data, and that its Indian digital signature certificate (DSC), eSign and enterprise solutions businesses remained unaffected.Srinivasan told TOI that no certificates had been issued from the affected root in India and that there was only one customer in the US to whom the company had issued certificates under the affected infrastructure. The global TLS business accounts for about 1% of eMudhra’s revenue, he said.“In FY26, we reported revenue of about Rs 710 crore and EBITDA of roughly Rs 110 crore,” Srinivasan told TOI. The company had guided revenue growth of 15–18%, with a greater focus on enterprise solutions, which offer higher margins. Its overall strategy remains unchanged, he said. Srinivasan said the use of eSign in India continues to grow as the country digitises, particularly in banking, lending and e-governance. “We are part of that growth. However, those certificates and operations have nothing to do with the affected certificates in this incident.”While the direct business impact is limited, reputational risk remains a concern. Srinivasan told TOI that the company could not yet quantify the reputational damage and was working directly with customers to address concerns and help them transition to alternative providers where necessary.The flaw appears to have occurred during the key-generation process rather than through an intrusion into the company’s systems. The company is investigating the root cause and will consider an independent investigation if its internal review does not establish what happened. It will share its findings with relevant stakeholders and browser companies, he said.The Indian Computer Emergency Response Team (CERT-In), in an advisory issued on Wednesday, warned that compromised keys could potentially be used to impersonate websites, intercept communications or issue fraudulent code-signing certificates that make malicious software appear to come from a trusted publisher. CERT-In has advised organisations to update browsers, applications and operating systems with the latest security patches.You use AI every day. Now get your AI Quotient. Take the AIQ test.