eMudhra shares plunge 14%, take three-day fall to 34%; here's why

Shares of eMudhra Ltd, an Indian certificate authority (CA), tumbled 14 per cent in Thursday's trade after it came under fire as eight of its certificates were found to have dangerously weak security keys, which could potentially allow attackers to create a fake digital certificate for almost any website.

EMudhra shares fell 14 per cent to hit a low of Rs 369.40 apiece. This was in addition to 20 per cent fall on the counter in the previous session after the report. The stock was also down 2.99 per cent on October 19.

eMudhra clarified that the incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally, it said.

eMudhra added that an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques and reported this to the major root programs such as Apple, Google, Microsoft and Mozilla, eMudhra said on Wednesday.

"The affected global TLS business is a very small part of eMudhra’s operations and accounts for around 1 per cent of the company’s revenue. However, this may have some reputational risks on eMudhra which cannot be quantified," it said.

eMudhra said it was working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation.

The matter related to eight of eMudhra’s several intermediate CAs that were trusted as part of its Global TLS business. These issuing CAs were created under eMudhra’s ECC root in a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).

"A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the
original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause. These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025," it noted.