Bengaluru-based eMudhra will exit its global digital certificate business after a security flaw hit eight of its intermediate certificates. Google, Apple, Microsoft, and Mozilla have stopped trusting the affected certificates. The company's share price fell about 40% in two days, according to Reuters.
eMudhra says it was not hacked and no data was stolen. Its Indian digital signature and eSign services are not affected.
The trouble began on April 30, 2025, during a key generation process. The process created weak keys along with the strong ones it was meant to make. The weak keys later became publicly discoverable through browser trust systems. These certificates help browsers verify a website’s identity and establish secure connections between users and websites.
An independent researcher found the weakness and told the big tech firms. Attackers could use weak keys to make fake certificates. With those, they could pose as real websites or software makers.
Google, Apple, Microsoft, and Mozilla acted through their own security systems. India's cyber agency, CERT-In, also issued an advisory on the risks.
Also Read: SBI Data Breach: 3,897 Customer Records Flagged on Dark Web
The company says its systems were not breached and that its Indian digital signature and eSign services run on separate systems and continue to operate normally
The global TLS business makes up only about 1% of eMudhra's revenue. But the harm to its name could be bigger. Its clients include Infosys and Tata Consultancy Services. The sharp share-price decline reflects investor concern.
eMudhra is now giving customers new certificates. It is also looking for the root cause of the flaw. This case shows how much the internet depends on trust. A single error in the certificate-generation process can undermine that trust quickly. eMudhra’s immediate priorities are to address the flaw, support affected customers, and maintain its Indian operations.