eMudhra Shares Decline 20% Following Security Flaw Discovery
Bengaluru-based digital trust and cybersecurity firm eMudhra has reported a cryptographic flaw affecting eight intermediate digital certificates in its global website-certificate business. This vulnerability could allow attackers to impersonate legitimate websites. Following the announcement, eMudhra’s shares plummeted by 20% on the Bombay Stock Exchange (BSE).
The company indicated that the impacted Transport Layer Security (TLS) business constitutes approximately 1% of its revenue. For the fiscal year 2026, eMudhra reported revenues of around Rs 710 crore and an EBITDA of roughly Rs 110 crore. The firm had previously projected a revenue growth of 15–18%, focusing on higher-margin enterprise solutions.
The flaw originated during a key-generation ceremony on April 30, 2025, when weak keys were inadvertently generated alongside the original strong keys. Mozilla cryptography engineer Dennis Jackson flagged the issue on October 17, citing insufficient randomness that rendered the keys vulnerable. eMudhra is currently investigating the root cause of the problem.
eMudhra is actively working with affected customers to replace the compromised TLS certificates to mitigate any potential disruptions. Co-founder Kaushik Srinivasan confirmed that no certificates from the affected root were issued in India, with only one customer in the U.S. impacted. The company assured that its infrastructure had not been breached and that its Indian digital signature certificate (DSC), eSign, and enterprise solutions remained unaffected.
Government officials have taken note of the incident, with the Ministry of Electronics and IT forming a special team to investigate. An official stated that the impact on Indian websites and applications has been minimal and brief. They emphasized that Digital Signature Certificates and eSign services, regulated by the Controller of Certifying Authorities, are completely unaffected by this incident.
In response to the vulnerability, Mozilla has blocked six affected certificates, issued security updates for Firefox, and removed the relevant root certificate from its trust store. Google has also blocked the affected public keys, extending protections to supported Android devices, while Cloudflare has implemented additional safeguards. The Indian Computer Emergency Response Team (CERT-In) has warned that compromised keys could facilitate website impersonation and the issuance of fraudulent code-signing certificates, urging organizations to install the latest security patches.
Observer Voice is the one stop site for National, International news, Sports, Editor’s Choice, Art/culture contents, Quotes and much more. We also cover historical contents. Historical contents includes World History, Indian History, and what happened today. The website also covers Entertainment across the India and World.
