eMudhra Shares Plunge 20% as Company Exits Global Website Security Certificate Business
Key Facts
eMudhra shares fell 20% to the lower price limit of 345.25 rupees on the Bombay Stock Exchange on Thursday, 22 October 2026, according to the Press Trust of India via Rediff. The decline came amid the fallout from a security incident involving the company's certificates and its board's announcement of a voluntary exit from the global website connection security certificate business. In its 21 October disclosure, eMudhra said the affected business accounts for about 1% of its revenue. It acknowledged, however, that the incident could entail "reputational risks to eMudhra that cannot be quantified". In its exit statement, the company cited rising data sovereignty and compliance requirements among the commercial reasons for withdrawing from the business.
The security developments stem from the exposure of private keys associated with 8 eMudhra intermediate certificates, Mozilla confirmed in its security statement. The Indian Computer Emergency Response Team said the affected private keys were generated using insufficient cryptographic randomness. Describing the flaw, eMudhra said a key-wrapping and unwrapping step produced an additional, weak set of keys. This set arose alongside the original strong keys, the company added in its statement on the certificate security incident. However, it said the precise root cause had yet to be established, stating: "We have not yet confirmed the exact root cause."
Clarifying the scope of the incident, eMudhra confirmed that the affected intermediate authorities had not issued any certificates to end users. "No certificates were issued from any of them," it said in its statement, referring to the intermediate authorities covered by the security measures. The company also said its infrastructure had not been compromised and the incident had not resulted in a data breach. The Indian Computer Emergency Response Team said India's digital signature certificate services infrastructure remained unaffected by the incident. Its assurance also covered the electronic signature service infrastructure, which it said remained entirely unaffected.
As part of containment efforts, eMudhra revoked the 8 affected intermediate certificates on 18 October 2026, according to the Indian Computer Emergency Response Team. Mozilla moved to block the affected certificates through its centralised certificate revocation list, according to its statement on protecting Firefox users. It said the mechanism protects browser users without requiring them to download an update or restart the browser. On the implications of removing trust, the Indian team warned that removing the relevant root certificate from trust stores could cause legitimate certificates issued under it to become untrusted. The warning concerns legitimate certificates under the root certificate subject to removal, according to the team's advisory.
For affected customers, eMudhra said it would contact them to arrange certificate replacements during the transition out of the business it has decided to leave. It pledged to provide replacements free of charge through its partners, saying it would work to "replace any certificate at no cost through partners". In its security incident statement, the company announced the availability of Sectigo-issued certificates as an alternative for customers. In its exit statement, it added that it would continue operating certificate revocation and status verification services during the transition. Those services will continue until all issued certificates expire or are replaced, according to the company's pledge.
At the government level, the incident is under investigation by India's Ministry of Electronics and Information Technology, according to NDTV Profit. The report said the ministry had formed a special team to investigate the eMudhra security incident. Alongside the investigation, browser measures include removing the relevant root certificate from the Chrome trust store, according to the same report. The change is scheduled to reach devices that rely on the browser's trust store. The report identified 27 October 2026 as the scheduled date for the root certificate removal to reach those devices.