eMudhra shares fall around 37% in two sessions after security incident

eMudhra shares fell around 37% in two sessions after the company disclosed a security incident involving its global Transport Layer Security business. The company said this business accounts for around 1% of its revenue. It also said its Indian Digital Signature Certificate and eSign services operate on separate infrastructure and were unaffected.

eMudhra shares fell to ₹345 after a 20% session decline

eMudhra shares fell another 20% in the latest session to an intraday low of ₹345, according to the share-price data cited in the report. The earlier session had also recorded a 20% fall, taking the decline across the two sessions to around 37%.

The affected TLS business accounts for around 1% of revenue

The affected global TLS business accounts for around 1% of eMudhra’s revenue, the company said. It added that the commercial impact may be limited because the business represents this share of revenue.

MeitY said eight certificates were linked to the incident

Private keys linked to eight intermediate Certificate Authority certificates were compromised, eMudhra reported. MeitY said the company’s Indian Digital Signature Certificate and eSign services, regulated by the Controller of Certifying Authorities under the ministry, remained unaffected.

The ministry said the incident was confined to eMudhra’s international digital-certificate business, which secures websites, software and online communications. The company said its Indian Digital Signature Certificate and eSign services run on infrastructure separate from its global TLS business.

MeitY said the effect on Indian websites and applications was very limited and lasted for a very short interval. eMudhra said the incident could create reputational risks whose extent could not be quantified.

eMudhra linked the issue to a key-generation flaw

A flaw in eMudhra’s Key Generation Ceremony created a second set of weak keys alongside the original strong keys, the company said in a regulatory filing. It said the weak keys were published to browser root stores and that it was working to establish the root cause.

The affected roots and issuing Certificate Authorities had undergone independent audits for two consecutive years, eMudhra said. The company also said they had been included in browser trust lists since mid-2025.

eMudhra is replacing certificates and investigating the root cause

eMudhra said it was working directly with customers who might be affected to provide replacement certificates. The company said it was working with root programmes and continuing its root-cause investigation.