Indian certificate authority eMudhra Ltd saw its shares plummet by 14% in Thursday's trading session, reaching a low of Rs 369.40 apiece. This sharp decline contributed to a staggering 34% fall over three trading days, following a 20% drop in the previous session and a 2.99% decrease on October 19.
The significant market reaction stems from the discovery that eight of eMudhra's intermediate Certificate Authority (CA) certificates were found to possess dangerously weak security keys. This critical flaw could potentially enable attackers to reverse-engineer these keys, possibly with AI-assisted techniques, and create fraudulent digital certificates for virtually any website.
Global TLS Business Affected, Indian Services Secure
eMudhra has clarified that the security incident is isolated and has no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses. The company stated that its global TLS (Transport Layer Security) business, where the vulnerability was identified, operates on infrastructure entirely separate from its Indian DSC services, which continue to run normally.
The affected global TLS business represents a very small fraction of eMudhra's total operations, accounting for approximately 1% of the company's revenue. However, the company acknowledged that the incident poses significant, albeit unquantifiable, reputational risks.
Investigation Underway for Key Generation Flaw
An independent researcher initially identified the weak keys and reported the issue to major root programs, including Apple, Google, Microsoft, and Mozilla. eMudhra confirmed that the problem relates to eight intermediate CAs under its ECC root, which were generated during a Key Generation Ceremony (KGC) on April 30, 2025.
The company explained that a flaw occurred during a wrap/unwrap step in the KGC, producing a second set of weak keys alongside the intended strong keys. These weak keys were inadvertently published to browser root stores. Despite having gone through independent audits for two years and being part of browser trust lists since mid-2025, the flaw remained undetected until recently.
eMudhra is actively working with affected customers to provide replacement certificates and prevent service disruptions. The company is also collaborating with root programs and conducting a thorough root-cause investigation to address the security lapse comprehensively.