BANGLURU/ NEW DELHI: Bengaluru-based digital trust and cybersecurity company eMudhra has acknowledged a cryptographic flaw that generated weak private keys linked to eight intermediate digital certificates in its global website-certificate business, potentially allowing attackers to impersonate legitimate websites. Shares fell 20% on BSE.The company said the affected TLS business accounts for around 1% of its revenue.eMudhra reported FY26 revenue of about Rs 710 crore and EBITDA of roughly Rs 110 crore. It had guided for revenue growth of 15–18%, with greater emphasis on higher-margin enterprise solutions.The flaw occurred during a key-generation ceremony on April 30, 2025, when a second set of weak keys was generated alongside the original strong keys. Mozilla cryptography engineer Dennis Jackson reported the issue on Oct 17, flagging insufficient randomness that made the keys vulnerable to recovery. eMudhra said it was investigating the root cause.
Shares fell 20% on BSE.
eMudhra said it was working with affected customers to replace Transport Layer Security (TLS) certificates and prevent disruption. Co-founder Kaushik Srinivasan told TOI that no certificates had been issued from the affected root in India and that only one US customer had received certificates under the affected infrastructure. The company said its infrastructure had not been breached and its Indian digital signature certificate (DSC), eSign and enterprise solutions businesses remained unaffected.Govt officials said the ministry of electronics and IT has taken serious note of the incident with a special team constituted to investigate the matter.“The impact of this incident on Indian websites and applications have been very limited and for a very short interval… Important to note that Digital Signature Certificates and eSign services regulated by Controller of Certifying Authorities, remain completely unaffected by this incident,” an official said.Mozilla blocked six affected certificates, released Firefox security updates and removed the relevant root certificate from its trust store. Google blocked the affected public keys, extending protection to supported Android devices, while Cloudflare introduced safeguards. Indian Computer Emergency Response Team (CERT-In) warned that compromised keys could enable website impersonation, interception of communications and the issuance of fraudulent code-signing certificates that make malicious software appear legitimate. It advised organisations to install the latest security patches.
