eMudhra shares crash 20% after security flaw hits TLS certificates
What's the story
Shares of Bengaluru-based eMudhra Ltd plummeted by 20% on Wednesday. The sudden plunge was triggered after a security researcher flagged a vulnerability in eight intermediate certificates issued by the Indian certificate authority. The researcher claimed that this flaw led to weak keys that could be reverse-engineered using AI-assisted techniques and reported the issue to major root programs run by Apple, Google, and Mozilla.
Company statement
Infrastructure intact, no data compromised: eMudhra
In response to the security breach, eMudhra has assured that its infrastructure remains intact and no data has been compromised.
The company emphasized that all physical and logical security controls are still in place.
It also clarified that this issue is unrelated to its Indian Digital Signature Certificate (DSC) and eSign business.
"The global TLS business runs on infrastructure that is completely separate from the India DSC business," said the company in a statement.
Financial implications
Potential reputational risks for eMudhra
The TLS business, which is separate from eMudhra's DSC and eSign services in India, contributes only 1% to the company's overall revenue.
However, eMudhra admitted that this incident "may have some reputational risks on eMudhra which cannot be quantified."
The company is now working with potentially affected customers to issue replacement certificates and secure critical services.
It is also collaborating with root programs while continuing its investigation into the root cause of this security breach.
Ongoing probe
Ongoing investigation into security breach
The company is investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) in April 2025.
This incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs.
The private keys associated with these certificates are so weak that they could be exploited by anyone to create trusted browser and app credentials for any website on the internet.