eMudhra shares tumbled to a 52-week low of ₹318 as the company announced an exit from its global TLS certificate business. This follows a security flaw discovered in a 2025 key generation event that led major browsers to revoke its digital certificates. Investors are now assessing the impact on the company’s revenue, as international markets previously contributed over 60% of its total income.
eMudhra shares continued a sharp decline on Monday, hitting a 52-week low of ₹318 on the BSE. The stock has faced heavy selling pressure, losing 43% of its value in just five trading sessions and falling 53% from its mid-September peak. The decline follows the company’s announcement that it will exit the global SSL/TLS certificate business following a critical security incident.
Security Breach and Browser Revocations
The crisis originated from a technical error during a key generation ceremony on April 30, 2025. This event produced a set of weaker cryptographic keys alongside valid ones, which were later published to browser root stores. The exposure was identified by an independent researcher on October 17, 2026, prompting immediate action from major global browsers. Consequently, Google, Mozilla, Microsoft, and Apple revoked the affected intermediates, which effectively halted the company’s ability to operate in the global TLS certificate segment.
Strategic Shift and Regulatory Scrutiny
In response to the mounting crisis, the eMudhra board announced an exit from the global TLS certificate business on October 22. The company plans to redirect its focus toward its core enterprise solutions and domestic trust services. This transition is critical, as the company previously derived 64% of its revenue from overseas markets. However, the exit does not end the company's challenges. The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident. Additionally, Google has confirmed plans to remove the emSign ECC Root CA – G3 from its Chrome Root Store starting October 27.
Ratings and Financial Risk
Despite the significant business disruption, credit rating agency ICRA has opted to maintain its [ICRA]A (Stable)/[ICRA]A1 ratings for the company's ₹35 crore credit limits. However, the agency issued a warning regarding profound risks, including potential long-term reputational damage, regulatory uncertainty, and the threat of declining customer retention. The agency also noted that the transition out of the global TLS business involves complex coordination with browser root programs. Any delays in this migration or new findings regarding the exploitation of the weak keys could lead to contingent liabilities and further erosion of investor confidence.
Investors will now be closely monitoring the company's ability to stabilize its domestic operations. Key monitorables include the outcome of the MeitY investigation, the speed at which the company can pivot its resources, and whether it can maintain its customer base during this transition period.