eMudhra Addresses Global TLS Certificate Integrity Issue

1% of total revenue impacted, with eight intermediate CAs and one root CA affected.

Reader Takeaway: The company faces limited direct revenue loss but must navigate potential reputational risks from global browser root programs.

What just happened

eMudhra Limited has disclosed that select global TLS (Transport Layer Security) intermediate Certificate Authorities and one root CA have been marked for 'distrust' by global browser programs. This follows the discovery of a flaw in a Key Generation Ceremony held on April 30, 2025. The issue, identified by an independent researcher, stemmed from a wrap/unwrap process error that produced weak keys alongside strong ones. These keys were subsequently included in major browser root stores, leading to the current distrust action.

Why this matters

Digital security certificates are the bedrock of internet trust. When a certificate authority is flagged for distrust by platforms like Google, Apple, Microsoft, and Mozilla, the certificates it issues are no longer recognized as secure, potentially disrupting customer operations. For eMudhra, this necessitates an immediate, resource-intensive replacement process for affected global clients to maintain service continuity.

Business and Security Impact

eMudhra has moved to clarify the scope of the incident to prevent market panic. The company emphasizes that its critical infrastructure, including physical and logical security controls, remains intact with no evidence of data compromise. Crucially, the company notes that its Indian Digital Signature Certificate (DSC) and eSign businesses operate on entirely separate infrastructure and remain completely unaffected by this global TLS incident.

Risks to watch

While the company has quantified the direct financial exposure at approximately 1% of total revenue, the primary risk for investors is reputational. The ability to maintain the integrity of security keys is paramount in the cybersecurity industry. Shareholders should monitor for any secondary impact on global client retention or further regulatory scrutiny from international browser root program operators.

What to track next

eMudhra is currently coordinating with affected customers to facilitate the replacement of certificates. The company has also initiated a formal root-cause investigation. Investors should look for updates regarding the successful completion of the replacement process and any formal closures of the investigation by international browser stakeholders.