Why eMudhra Share Price Is Falling Today: 20% Drop

The short version

• eMudhra shares fell 20% to Rs 432 after concerns emerged over eight intermediate certificate authorities.
• A key generation flaw created weak private keys that could potentially allow attackers to issue website certificates.
• The affected global TLS business contributes about 1% of revenue, but reputational risks remain.

eMudhra Ltd. shares fell 20% to Rs 432 apiece on Wednesday, October 21, after major browser trust programmes took action against certificates linked to the company's global Transport Layer Security (TLS) business. The incident centres on a flaw that produced weak cryptographic keys for eight intermediate certificate authorities.

The issue has led to certificate revocations and changes to browser trust lists. Mozilla removed eMudhra's emSign ECC Root CA G3 from its trust store on October 20, while Google said its removal was expected to reach devices relying on the Chrome Root Store on October 27.

For investors, the immediate concern is the potential effect on customer confidence and the company's standing in the global digital trust market. eMudhra said the affected business accounts for about 1% of its revenue. It also warned that the reputational impact could be difficult to quantify.

What went wrong with eMudhra's TLS certificates?

The problem involved eight intermediate certificate authorities created under eMudhra's elliptic curve cryptography (ECC) root during a key generation ceremony on April 30, 2025. The company said it used hardware security modules certified to FIPS 140 2 Level 3 standards during the process.

According to eMudhra's explanation in the public incident record, a flaw in the ceremony script created a second set of weak key pairs during a key wrapping test. The intended strong keys and the additional weak keys were generated on the hardware security module. However, the weak keys were subsequently used for certificate requests and published to browser root stores.

A certificate authority, or CA, is an organisation that issues digital certificates used to establish trust between websites and users. An intermediate CA can sign certificates presented by websites. If its private key is compromised, an attacker could potentially issue fraudulent certificates that browsers accept as legitimate.

Mozilla security researcher Dennis Jackson documented the weakness in the affected keys. The keys used integers below 256, making them easy to recover through a small number of guesses. One private key associated with the EM OV TLS CA G3C certificate had a value of just four.

The researcher who first identified the problem demonstrated that the eight private keys could sign a message. Mozilla independently recovered the keys in under two hours. The company said it was still investigating the root cause and acknowledged human errors at multiple stages of the process.

Important details of the security incident

Particulars	Details
Company	eMudhra Ltd.
Share price after the fall	Rs 432
Share price decline	20%
Affected intermediate CAs	8
Key generation date	April 30, 2025
Affected business	Global TLS
Share of company revenue	About 1%
eMudhra certificate revocation	October 18, 2026
Mozilla root removal	October 20, 2026
Expected Chrome Root Store removal	October 27, 2026

The incident has drawn attention to how cryptographic keys are generated, checked and assigned to certificate requests. Hardware security modules are designed to protect sensitive cryptographic operations, but the company's explanation points to a flaw in the surrounding process that allowed weak keys to be used.

eMudhra said its roots and issuing certificate authorities had passed independent audits for two consecutive years. They had also been included in browser trust lists since mid 2025. Those earlier checks did not prevent the weak keys from being used.

How browsers responded to the incident

Browser operators moved quickly after receiving the report. The Chrome Root Program received the report at 18:05 UTC on October 17 and had blocked six TLS intermediate certificates by 19:45 UTC that day. The certificates were blocked on Apple devices from October 19 and on Microsoft platforms from October 20.

eMudhra revoked the affected certificates on October 18. Sectigo, which had cross signed the certificates, followed with its own revocation on October 19.

The response later extended beyond the eight intermediate certificates. Mozilla removed eMudhra's emSign ECC Root CA G3 from its trust store on October 20. Google said removal of the same root was expected to reach devices using the Chrome Root Store on October 27.

Google also said it was closely examining whether eMudhra's remaining certificate authorities should continue to be trusted in the Chrome Root Store. That review matters because the decision could affect the company's wider TLS operations, even though the initial technical problem involved eight intermediate authorities.

Browser trust lists help determine which digital certificates devices and applications accept. Removing a root certificate can have wider consequences than blocking individual intermediates because trust in certificates issued under that root may also be affected, depending on the platform and certificate chain.

What eMudhra said about data security and its Indian business

eMudhra said its infrastructure had not been compromised and that no data had been breached. It also said its physical and logical security controls remained intact.

The company separated the incident from its Indian Digital Signature Certificate and eSign operations. According to eMudhra, those businesses run on infrastructure that is completely separate from the global TLS business and continue to operate normally.

This distinction is relevant because digital signatures and website TLS certificates serve different purposes. Digital signature services can help authenticate documents and electronic transactions, while TLS certificates help browsers establish secure connections to websites.

However, the separation of infrastructure does not remove the potential reputational impact on eMudhra's wider digital trust business. Customers may assess the company's controls and processes across its services when deciding whether to continue using them.

eMudhra said it was working directly with potentially affected customers to issue replacement certificates. The aim is to prevent disruption to critical services while the root cause investigation continues.

Market analysis: why the incident matters for eMudhra shares

The affected TLS business contributes about 1% of eMudhra's revenue, according to the company. That limits the direct revenue exposure identified in its statement, but the incident could have consequences beyond the business line's current size.

Certificate authorities depend on trust from browser operators, customers and other technology providers. Removal from a root store can restrict the acceptance of certificates associated with that authority. Restoring confidence may therefore depend on the findings of the technical investigation and decisions by browser trust programmes.

The share price reaction also places attention on the possible cost of replacing certificates, supporting customers and addressing the incident. eMudhra has not provided a quantified estimate of these costs in the supplied statement. The financial effect cannot be determined from the revenue contribution alone.

Investors have seen sharp share price reactions to company specific developments in other sectors as well. For example, Godrej Consumer Products shares fell after a CEO exit, while IndusInd Bank shares dropped despite a quarterly earnings beat. Those events involved different business issues, but they show how company specific concerns can influence market sentiment.

For eMudhra, the next phase will depend on the technical findings, browser operators' decisions and the company's ability to replace affected certificates without disrupting customers.

What investors should watch

The company's next disclosures and the outcome of the ongoing investigation will help clarify the potential business impact. Relevant developments include:

• The final root cause identified by eMudhra and the corrective steps taken.
• Google's review of eMudhra's remaining certificate authorities and the expected October 27 root removal.
• Progress in replacing certificates for affected customers.
• Any quantified costs, customer losses or changes to revenue expectations.
• Further changes to trust lists maintained by major browser programmes.

The distinction between the affected global TLS business and eMudhra's separate Indian digital signature operations will also matter in assessing the scope of the incident. The company has said those Indian services continue to function normally.

About eMudhra

eMudhra Ltd. is a digital trust company with businesses that include global TLS certificates, Indian Digital Signature Certificates and eSign services. The current incident concerns eight intermediate certificate authorities associated with its global TLS operations.

The company's immediate task is to complete the investigation, replace affected certificates and work with browser trust programmes. Google's expected October 27 action and any subsequent decisions on the company's remaining certificate authorities are the next dates to monitor.

Frequently asked questions

Why did eMudhra shares fall 20%?

eMudhra shares fell 20% to Rs 432 on October 21, 2026, after concerns emerged over weak cryptographic keys used by eight intermediate certificate authorities in its global TLS business. Browser trust programmes blocked affected certificates, and Mozilla removed an eMudhra root certificate from its trust store.

What caused the eMudhra TLS certificate problem?

A flaw in eMudhra's key generation process on April 30, 2025, created a second set of weak private keys during a key wrapping test. The weak keys were used in certificate requests and published to browser root stores. One affected private key had a value of four, making it easy to recover.

How many eMudhra certificate authorities were affected?

Eight intermediate certificate authorities were affected by the weak key generation problem. They were created under eMudhra's ECC root for its global TLS business. The company said it was investigating the root cause and working with affected customers.

Has eMudhra reported a data breach?

No. eMudhra said its infrastructure had not been compromised, no data had been breached and its physical and logical security controls remained intact. The company also said its Indian Digital Signature Certificate and eSign businesses operate on separate infrastructure and were functioning normally.

What is the impact of the eMudhra incident on revenue?

eMudhra said the affected global TLS business contributes about 1% of its revenue. However, the company warned that reputational risks could be difficult to quantify. It has not provided a specific estimate of the incident's total financial cost in the supplied statement.

What happens next in the eMudhra certificate incident?

eMudhra is investigating the root cause and issuing replacement certificates to potentially affected customers. Google said removal of eMudhra's emSign ECC Root CA G3 was expected to reach devices using the Chrome Root Store on October 27, 2026. Google was also reviewing whether the company's remaining certificate authorities should remain trusted.