eMudhra has identified a technical flaw in its global TLS certificate generation, requiring replacements for some clients. The company states its Indian Digital Signature Certificate services remain unaffected. The issue impacts approximately 1% of total revenue, with no evidence of unauthorized access or data breaches.
eMudhra has announced that it is initiating a certificate replacement process for some of its global Transport Layer Security (TLS) customers following the discovery of a technical vulnerability. The company disclosed on Wednesday that a key generation event held on April 30, 2025, inadvertently produced weak cryptographic keys along with valid ones. These keys were subsequently published to browser root stores, making them susceptible to being reverse-engineered.
The issue affects eight intermediate certificate authorities under the company’s ECC root. The vulnerability was brought to the company's attention on October 17, 2026, by an independent researcher who also notified major browser operators, including Google, Apple, Microsoft, and Mozilla. In response, eMudhra is now coordinating with its global customers to facilitate the necessary certificate replacements to maintain service security and prevent potential outages.
From a business and financial perspective, the impact of this incident is limited to the company’s global TLS operations, which account for approximately 1% of its total revenue. The company’s core business segments, including its Indian Digital Signature Certificate (DSC) and eSign services, operate on separate, independent infrastructure. These domestic services are entirely unaffected by this flaw and continue to operate normally.
The company has emphasized that its infrastructure remains secure. According to the official statement, internal physical and logical security controls are fully intact, and there is no evidence that any unauthorized access or data breach has occurred. While the technical flaw requires a corrective operational step for global clients, the company maintains that its core security controls were not compromised.
Investors should note that while the direct financial impact on revenue is minimal, the company faces potential reputational risks as it manages the replacement process with international stakeholders. The company is actively working with international browser root programs to resolve the matter and verify the security of its updated systems. The primary focus for the company in the near term will be the successful execution of the certificate replacement process across its affected global customer base. The speed and efficiency of this transition will be a key area for monitoring to ensure that customer service levels remain stable and to mitigate any lingering reputational concerns.