eMudhra shares fall 4% as company exits global SSL/TLS certificate business

eMudhra shares fell 4% to ₹331 on the BSE on Friday after the company announced it would voluntarily exit its global SSL/TLS certificate business following a compromise of private keys linked to eight intermediate Certificate Authority certificates. The company said its infrastructure was not compromised and no data was breached.

eMudhra chooses to leave its global SSL/TLS certificate business

eMudhra announced that it would voluntarily exit its global SSL/TLS certificate business after private keys linked to eight intermediate Certificate Authority certificates were compromised. The company said its board reached the decision after detailed deliberations.

BSE data showed that eMudhra shares fell 4% to ₹331 on Friday. The company said no end-entity certificates had been issued by the affected Certificate Authorities, its infrastructure had not been compromised, no data had been breached, and its physical and logical security controls remained intact.

eMudhra shares fall 39% across three sessions

BSE data showed that eMudhra shares were down 39% over three sessions.

Eight intermediate Certificate Authority certificates linked to compromised private keys

eMudhra said a flaw in its key-generation ceremony created a second set of weak keys alongside the original strong keys. The company said the weak keys were published to browser root stores.

An independent researcher found that the weak keys could be reverse-engineered and reported the matter to the Apple, Google, Microsoft and Mozilla root programmes, eMudhra said. The company added that the affected roots and issuing Certificate Authorities had undergone independent audits for two consecutive years and had been included in browser trust lists since mid-2025.

CERT-In issued an urgent advisory earlier in the week after eMudhra reported the compromise involving eight intermediate Certificate Authority certificates. The Ministry of Electronics and Information Technology said eMudhra’s Digital Signature Certificate and eSign services, regulated by the Controller of Certifying Authorities, remained unaffected.

The Ministry of Electronics and Information Technology said the impact on Indian websites and applications had been very limited and lasted for a very short interval.

SSL/TLS segment contributes about 1% of global revenue

V. Srinivasan, chairman of eMudhra, said the global SSL/TLS certificate business contributed about 1% of eMudhra’s global revenue. He said data-sovereignty and compliance requirements had increased the segment’s complexity and operating cost.

Srinivasan said the availability of free SSL/TLS certificates had reduced the segment’s business case and return on investment relative to eMudhra’s overall revenue base. eMudhra said the incident had attracted social-media attention and scrutiny disproportionate to the segment’s contribution to its business.

Root-cause work and replacement certificates continue

eMudhra said it was still working to establish the root cause of the flaw in the key-generation ceremony. The company said it was working directly with affected customers to provide replacement certificates so that critical services were not disrupted.

The company also said it was continuing to work with browser root programmes. eMudhra said the extent of the incident’s reputational risks could not be quantified.