It was the kind of week no listed company wants. Bengaluru-based eMudhra, one of India’s few globally trusted digital certificate authorities, watched its shares crash for the second straight day on Thursday, ending nearly 20 per cent lower at a 52-week low, even as the central government ordered a special investigation into a security breach at the heart of its global operations.
On the NSE, the stock tumbled 19.91 per cent to Rs 346 apiece. On the BSE, it tanked 19.63 per cent to Rs 346.85. A combined 9.06 million shares changed hands across the two exchanges, as investors rushed for the exits. The fall came a day after the Ministry of Electronics and Information Technology (MeitY) said it had taken “serious note” of the incident and formed a special team to investigate.
At the centre of the storm is something most internet users never think about: the private keys behind the digital certificates that tell your browser a website is genuine. India’s cyber security watchdog CERT-In issued an advisory cautioning that private keys used for eMudhra’s certificates had been “generated with insufficient cryptographic randomness”, leading to their compromise.
What actually went wrong
According to the company’s own exchange filing, the problem traces back to a Key Generation Ceremony held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules. A flaw in a wrap and unwrap step during that ceremony produced a second set of weak keys alongside the original strong ones. It was the weak keys that ended up being published to browser root stores.
An independent researcher spotted the issue on October 17, realising the weak keys could potentially be reverse-engineered, especially using AI-assisted methods. The researcher alerted the major browser root programmes run by Apple, Google, Microsoft and Mozilla. The disclosure cascaded quickly: CERT-In issued its advisory, eMudhra informed the exchanges, and the government stepped in.
In total, private keys linked to eight intermediate certificates were compromised: six TLS certificates and two code-signing certificates used in the company’s global operations. CERT-In warned that an attacker recovering these keys could issue fraudulent certificates for domains they do not control, impersonate legitimate websites and run man-in-the-middle attacks that intercept or modify encrypted traffic.
Why investors panicked
The market reaction tells its own story. After the disclosure broke on Wednesday, the stock hit a 20 per cent lower circuit. Thursday brought the MeitY investigation announcement, and the stock hit the circuit again, its second straight 20 per cent wipeout. For a company valued on trust, literally, this is existential territory.
eMudhra, founded in 2008, has issued more than 60 million digital certificates and operates across more than 35 countries. The affected global TLS business represents only about 1 per cent of its revenue, but the reputational damage cuts deeper. In the certificate world, once browser root programmes lose confidence, business dries up fast.
The government’s position
MeitY moved quickly to contain the narrative. In a statement issued on Wednesday, the ministry said the incident pertained only to eMudhra’s international website-security business, which operates under a global trust framework and independent WebTrust audits. It emphasised that Indian Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities under MeitY, are completely unaffected.
The ministry said the impact on Indian websites and applications was “very limited” and called out some social media accounts for what it described as “fear-mongering” about the incident. CERT-In has issued mitigation measures, and the ministry said it remains engaged with stakeholders to resolve the matter at the earliest.
What the company says
eMudhra’s leadership insists the actual exposure is narrower than it looks. Co-founder Kaushik Srinivasan told PTI that the weak keys were created by eight out of forty certifying authorities but were never put to commercial use.
“There is no impact to subscribers because we have done all the actions,” Srinivasan said, adding that the company is working with customers to notify them that there is no impact because no certificates were ever issued with the compromised keys. He said the incident does not affect the company’s India digital signature and enterprise solutions business.
The company also stressed that its core infrastructure remained intact, with no data breach and all physical and logical security controls unaffected.
Why this matters to you
For the average Indian internet user, the immediate risk is low. MeitY has said the impact on Indian sites is very limited, and the company says no fraudulent certificates were actually issued. But the episode is a reminder of how the internet’s trust system works, and how fragile it can be. A handful of companies worldwide hold the keys that browsers trust, and a single flawed key ceremony can shake that foundation.
- Check for browser and OS updates, which carry revoked certificate lists.
- Watch for HTTPS warnings and never ignore certificate errors.
- Indian DSC and eSign users: your services are unaffected, per MeitY.
- Investors: the stock is at a 52-week low after two straight circuit hits.
The special investigation team will now determine exactly how a certified ceremony produced weak keys and whether any certificates were misused before the flaw was caught. For eMudhra, the harder job begins after the probe: rebuilding the trust its entire business is built on.
FAQs
What happened at eMudhra?
Private keys linked to eight of eMudhra’s intermediate certificates were compromised after a flaw in a key generation ceremony on April 30, 2025 produced weak keys alongside strong ones. The weak keys were published to browser root stores.
Are Indian users and websites affected?
According to MeitY, the impact on Indian websites is “very limited”. Indian Digital Signature Certificate and eSign services regulated by the CCA are unaffected.
Why did eMudhra shares crash?
The stock hit 20 per cent lower circuits on two straight days after the disclosure and the government’s decision to form a special investigation team. It closed Thursday at a 52-week low of Rs 346 on the NSE.
What did CERT-In warn about?
CERT-In warned that attackers recovering the private keys could issue fraudulent certificates, impersonate legitimate websites and intercept encrypted communications through man-in-the-middle attacks.
What has the government done?
MeitY has formed a special team to investigate, issued mitigation measures through CERT-In, and cautioned against fear-mongering on social media. It says it is engaged with all stakeholders to resolve the incident at the earliest.
Stay with Informeia for the latest on this developing story.
