eMudhra Shares Plunge 20% Amid Certificate Authority Concerns

Shares of eMudhra dropped sharply by 20 percent, settling at ₹431.55 on the Bombay Stock Exchange during Wednesday’s trading session. This decline was triggered by reports questioning the reliability of certain intermediate Certificate Authorities (CAs) used in the company’s global Transport Layer Security (TLS) operations.

eMudhra operates as a global provider specializing in digital identity, trust, and security solutions. Its services support secure digital transformations for banks, financial institutions, enterprises, and government entities across more than 35 countries. The company offers a range of products, including CertiNext for public key infrastructure (PKI) and certificate lifecycle management, SecurePass for identity and access management with multi-factor authentication, and PrivaTrust, which focuses on data discovery and consent management to meet global data privacy regulations.

By late morning on Wednesday, about 2.28 million shares of eMudhra had traded hands. The stock saw pending sell orders amounting to 226,916 shares on both the NSE and BSE. This fall adds to a steep 35 percent decline in the stock price over the last month, following a 52-week peak of ₹680 recorded on October 21, 2025.

The sudden drop comes after eMudhra addressed concerns raised on October 10, 2026, regarding the trustworthiness of eight intermediate CAs that form part of its global TLS business. These CAs were generated under the company’s ECC root during a Key Generation Ceremony (KGC) on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).

According to eMudhra, a flaw during the KGC led to the creation of two sets of keys: one strong and one weak. The weak keys were inadvertently published to browser root stores, potentially compromising security. The company is currently investigating the root cause of this anomaly.

These root and issuing CAs have undergone independent audits for two consecutive years and have been included in browser trust lists since mid-2025. However, last weekend, an independent researcher discovered that the weak keys might be susceptible to reverse-engineering through AI-assisted methods. This vulnerability was reported to major root programs operated by Apple, Google, Microsoft, and Mozilla.

Despite the issue, eMudhra confirmed that its infrastructure was not breached, and no data compromises occurred. All physical and logical security measures remained intact throughout. The company also clarified that this situation does not affect its Indian Digital Signature Certificate (DSC) and eSign services, which operate on separate infrastructure and continue to function normally.

The global TLS segment implicated in this event represents only about 1 percent of eMudhra’s total revenue. Nevertheless, the company acknowledged potential reputational risks that are difficult to measure at this stage.

In response to the situation, eMudhra is collaborating directly with impacted customers to provide replacement certificates, aiming to avoid disruptions in critical services. Additionally, the company is working closely with root programs and pursuing a thorough investigation to identify the exact cause of the problem.

eMudhra’s experience highlights the challenges digital security providers face in maintaining trust and reliability in an environment where cryptographic keys and certificates are foundational to secure communications. The incident underscores the importance of rigorous key management practices and the continuous monitoring of security protocols to prevent vulnerabilities.

As digital transformation accelerates across industries, companies like eMudhra are pivotal in enabling secure online transactions and communications. The evolving landscape of cybersecurity requires constant vigilance and rapid response to emerging threats or technical issues that may affect service integrity.