eMudhra shares hit the 20% lower circuit at ₹431.55 on October 21 after browsers blocked eight of its intermediate certificate authorities over weak keys. The company says global TLS is about 1% of revenue and Indian services are unaffected.
How the Stock Reacted on October 21
eMudhra’s share price was locked at the 20% lower circuit at ₹431.55 on the BSE during Wednesday’s intraday trade. Business Standard reported that, until 11:08 am, a combined 2.28 million shares changed hands on the NSE and BSE, with pending sell orders for 226,916 shares. With the fall, the stock has declined 35% over the past month. Its 52-week high was ₹680, hit on October 21, 2025.
A lower circuit is the maximum permitted fall in a single day, so the stock could not fall further during that session.
What Went Wrong in the Key Ceremony
eMudhra is a digital identity and trust provider that issues digital certificates, among other products. The problem concerns eight intermediate certificate authorities (CAs) in its global TLS business. TLS certificates are what let a browser confirm that a website is genuine, and intermediate CAs are the layer between the trusted root and the certificates issued to websites.
According to the company’s statement, the eight intermediates were created under its ECC root in a key generation ceremony on April 30, 2025, using hardware security modules certified to FIPS 140-2 Level 3. A flaw in the ceremony caused a wrap and unwrap step to produce a second, weak set of keys alongside the original strong ones. The weak keys were the ones published to the browser root stores. eMudhra said it is working to establish the root cause, and that human errors in multiple steps of the process left significant flaws in the integrity of the key lifecycle for that ceremony, as quoted by SecurityWeek.
Google said the keys were generated with weak randomness, which could let anyone forge trusted certificates that impersonate websites on clients that have not removed trust in those CAs, according to SecurityWeek.
Timeline of the Incident
| Date | Event |
| April 30, 2025 | Key generation ceremony creates the eight intermediates |
| October 17, 2026 | A researcher reports the compromise to the browser root programs, and Chrome and Firefox block the certificates |
| October 19, 2026 | eMudhra revokes all eight intermediates, and Apple devices block them |
| October 20, 2026 | Microsoft platforms block them, Mozilla removes the emSign ECC Root CA G3 and publishes its notice |
| October 21, 2026 | eMudhra issues a further update and files a press release with the BSE |
What eMudhra Says Is and Is Not Affected
The company has made several points in its statements and its exchange filing:
- Its infrastructure was not compromised, no data was breached and its physical and logical security controls remained intact.
- The incident has no connection with its Indian Digital Signature Certificate and eSign businesses, which run on completely separate infrastructure and are working normally.
- The global TLS business accounts for around 1% of revenue, though the company said there may be reputational risk that cannot be quantified.
- It is giving affected customers replacement certificates so that critical services are not disrupted, and it is working with the root programs on the root-cause investigation.
- Its October 20 statement said only one of the eight intermediates was deployed in production and that none of them had issued any end-entity certificate, as reported by The Hacker News.
- It said it was not aware of evidence that the weak keys were recovered or exploited by anyone before the issue was disclosed.
Also Read: Jio IPO Day 1: QIBs Bid 9.42x While Retail Lags at 0.73x
What Happens Next
The eMudhra statement said the company will re-verify every key ceremony it has conducted over the next week. The browser and operating system vendors have already blocked the affected intermediates, and Mozilla said it does not currently believe the problem affects other certificate authorities. Chrome also said it checked the other CA certificates in its store and found no other instances of this failure.
Open questions include the scale of customer migration, the outcome of the root-cause investigation and any further decisions by the root programs on eMudhra’s remaining roots. None of those had been resolved at the time of the reports.
