eMudhra Shares Crash 20% After Security Researcher Flags Weak Encryption Keys In Eight TLS Certificates

Shares of eMudhra Ltd experienced a sharp 20% decline on Wednesday following a security researcher's discovery of a potential vulnerability linked to eight intermediate certificate authorities utilized in the company's global digital security operations. The stock price dropped to ₹432 on the National Stock Exchange (NSE), triggering investor apprehension regarding the incident's potential ramifications.

The researcher alleged that the compromised certificates contained weak cryptographic keys that could potentially be decrypted using artificial intelligence techniques. The findings were disclosed to major browser root program operators managed by Apple, Google, and Mozilla. eMudhra firmly denied any data breach, affirming that its physical and digital security measures remained intact.

The vulnerability was confined to the company's global Transport Layer Security (TLS) operations, which function independently from its Indian Digital Signature Certificate (DSC) and eSign services. Approximately 1% of eMudhra's revenue stems from its global TLS segment. While the company acknowledged that the incident posed reputational risks whose financial impact remains undetermined, it is reaching out to affected customers to replace certificates and safeguard crucial services.

Moreover, eMudhra is collaborating with browser root program operators and conducting an investigation into the technical glitch. The problem involves eight intermediate certificate authorities established under eMudhra's elliptic curve cryptography (ECC) root, created during a key generation ceremony on April 30, 2025, employing hardware security modules certified to Federal Information Processing Standards (FIPS) 140-2 Level 3.

An error during a cryptographic wrapping and unwrapping process resulted in the generation of a secondary set of weaker keys alongside the original secure keys. These weaker keys were subsequently published to browser root stores. eMudhra stated that the affected infrastructure underwent independent audits for two consecutive years and was included in browser trust lists since mid-2025. The company is actively investigating the incident and implementing corrective measures.