The Bengaluru digital trust and cybersecurity company eMudhra has acknowledged a cryptographic flaw that generated weak private keys linked to eight intermediate digital certificates in its global website-certificate business, potentially allowing attackers to impersonate legitimate websites.
Its shares fell 20 per cent on the BSE. The company said the affected Transport Layer Security business accounts for around 1 per cent of its revenue. eMudhra reported FY26 revenue of about Rs 710 crore and EBITDA of roughly Rs 110 crore, and had guided for revenue growth of 15 to 18 per cent with greater emphasis on higher-margin enterprise solutions.
The flaw dates to a key-generation ceremony on 30 April 2025, when a second set of weak keys was generated alongside the original strong keys.
It was reported on 17 October by Dennis Jackson, a cryptography engineer at Mozilla, who flagged insufficient randomness that made the keys vulnerable to recovery. eMudhra said it was investigating the root cause.
The response from the browser makers was quick. Mozilla blocked six affected certificates, released Firefox security updates and removed the relevant root certificate from its trust store. Google blocked the affected public keys, extending protection to supported Android devices, and Cloudflare introduced safeguards.
India's Computer Emergency Response Team warned that compromised keys could enable website impersonation, interception of communications and the issuance of fraudulent code-signing certificates that make malicious software appear legitimate. It advised organisations to install the latest security patches.
eMudhra said its infrastructure had not been breached and that its Indian digital signature certificate, eSign and enterprise solutions businesses were unaffected. Co-founder Kaushik Srinivasan told The Times of India that no certificates had been issued from the affected root in India, and that only one US customer had received certificates under the affected infrastructure. The company said it was working with affected customers to replace TLS certificates and prevent disruption.
The ministry of electronics and IT has taken serious note of the incident and constituted a special team to investigate. "The impact of this incident on Indian websites and applications have been very limited and for a very short interval... Important to note that Digital Signature Certificates and eSign services regulated by Controller of Certifying Authorities, remain completely unaffected by this incident," an official said.
The detail to dwell on is the ceremony. A key-generation ceremony is a formal procedure with a single intended output: numbers that nobody else can work out. This one produced two outputs. It produced the keys it was for, and it produced a second set alongside them.
On the narrowest reading, nothing was omitted. The strong keys were generated. They exist. The ceremony met its specification and then exceeded it, and the surplus is the part that turned out to be recoverable.
What the seventeen months since April 2025 establish is that the two sets were indistinguishable in every respect the ceremony was equipped to notice. The weak keys looked like keys. They behaved like keys. They were issued as keys. The single property separating them from the strong ones was that somebody else could derive them, and that property is not visible from the inside.
Our analysts note that this is why the market's reaction looks disproportionate and is not. One per cent of revenue was affected and a fifth of the company's value went with it, because the product on sale was never the certificate. The Department of Unnecessary Research has asked eMudhra for the only figure that now matters, which is how many other ceremonies produced more than they were asked for.