eMudhra Exits Global SSL: Why 8 Weak Keys Matter Beyond Revenue

eMudhra Limited has decided to exit its global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business after a key-generation flaw left eight intermediate certificate authorities (CAs) with weak cryptographic keys. The incident triggered browser security action and a wider review of trust in the company’s global certificate infrastructure.

Although the business contributes about 1% of revenue, the consequences may extend beyond the division being discontinued. Credit rating agency ICRA retained eMudhra’s ratings on October 23 but, according to reporting on its assessment, flagged potential reputational damage, regulatory uncertainty and customer-retention risks.

eMudhra says none of the eight affected intermediates issued end-user certificates, its infrastructure was not compromised and no data was breached. However, Google has also announced the removal of the associated emSign ECC Root CA – G3 from its Chrome Root Store, a separate step that could affect some legitimate certificates. The final root-cause findings and the impact on customer confidence remain important uncertainties.

Need to Know

Sources: eMudhra, CERT-In, Google, NSE and ICRA.

What Went Wrong With eMudhra’s Security Keys?

The incident originated during a key-generation ceremony on April 30, 2025. According to eMudhra, a key wrap/unwrap step generated a second, weak set of cryptographic keys alongside the original strong keys. The weak keys were subsequently published in the affected certificate hierarchy.

CERT-In said the affected P-384 elliptic-curve private keys had values below 256 and could be recovered almost instantly from their corresponding public keys. The weakness arose from the key-generation procedure, rather than a break in the underlying P-384 cryptographic algorithm.

The problem reportedly remained undetected for about 18 months, including two independent audit cycles. An independent security researcher reported the issue on October 17, 2026, prompting action from browser-security operators and eMudhra.

The technical risk was significant because an attacker who recovered an affected private key could potentially create fraudulent certificates to impersonate websites. CERT-In also warned that compromised code-signing keys could be used to create fraudulent software-signing certificates.

However, the public evidence does not establish that such misuse occurred. CERT-In said the disclosures available as of October 21 did not confirm malicious exploitation of the affected keys.

Why the Root-Certificate Issue Matters

eMudhra says seven of the eight affected intermediates were never used in production. The remaining intermediate was deployed in production but had not issued a single end-user certificate. The company says the root CA private keys and other intermediate CAs were not compromised.

That narrows the evidence of direct customer exposure, but it does not make the wider trust-store response irrelevant.

Google blocked the affected TLS intermediates in Chrome and announced the removal of emSign ECC Root CA – G3 from the Chrome Root Store. The removal was expected to reach devices relying on that store on October 27, 2026, Pacific time. Google warned that some legitimate certificates chaining to the root could stop working in Chrome and advised affected website operators to migrate to another trusted certificate hierarchy.

eMudhra has said the root distrust affects one customer ecosystem in the United States and that the majority of its TLS certificates remain unaffected because they chain to other trusted hierarchies.

The distinction is critical: the eight weak intermediates did not issue end-user certificates, but the separate root-certificate change can still create migration work for legitimate certificates associated with the broader hierarchy.

Why Exit a Business That Contributes Only 1% of Revenue?

eMudhra’s board announced the voluntary exit on October 22, saying the company would focus on core enterprise solutions and trust services outside global SSL/TLS certificates.

Management cited rising compliance and data-sovereignty requirements, increasing operational complexity and costs, and competition from providers offering certificates free of charge. It also acknowledged that the incident had generated scrutiny disproportionate to the division’s size.

The direct revenue effect may therefore be limited. The broader risk is harder to calculate.

Digital-trust businesses depend on customers having confidence in the security and reliability of the provider. If the incident affects customer acquisition, retention or the company’s credibility in overseas markets, the impact could reach beyond the discontinued certificate business.

That is the key investor tension: a small revenue stream may have a much larger reputational footprint.

ICRA Retains Ratings, but Risks Remain

ICRA’s October 23 rating communication retained [ICRA]A (Stable)/[ICRA]A1 for eMudhra’s ₹35 crore of unallocated bank limits. The rating decision followed a review after the incident in the global TLS certificate business.

Reporting on ICRA’s assessment said the agency flagged reputational risks, possible regulatory scrutiny and uncertainty over customer retention. The direct earnings impact of the business exit was expected to be limited because global SSL/TLS contributes about 1% of consolidated revenue.

The wider concern is whether the incident affects eMudhra’s ability to win and retain customers in its enterprise solutions business and overseas markets, which together account for a much larger share of revenue. This is a risk to monitor, not evidence that those revenues have already been lost.

Retained credit ratings should not be interpreted as a stock recommendation or a guarantee that the company will avoid further costs, claims or commercial disruption.

Are eMudhra’s Indian Digital Signature and eSign Services Affected?

CERT-In and eMudhra say the incident does not affect the company’s Indian Digital Signature Certificate (DSC) and eSign services. The domestic signing infrastructure operates separately from the global browser-trusted certificate business and uses distinct cryptographic keys.

eMudhra has also said its enterprise applications and identity and authentication services continue to operate normally.

Customers should not infer that these services were compromised simply because the global SSL/TLS incident occurred. Equally, the assurance about separate infrastructure should not be read as proof that all wider business risks have disappeared.

What Should Investors Watch Next?

On October 23, eMudhra shares closed at ₹353.70 on the NSE, up 2.34% for the day. The exchange’s one-week performance indicator showed a decline of 35.97%. The daily rebound does not establish that the security-related uncertainty has passed or that the incident explains the entire weekly move.

The next developments that matter are the company’s final root-cause report, progress in migrating affected certificates, regulatory findings and any evidence of changes in customer retention or order flow.

eMudhra has committed to publishing its root-cause findings and assisting affected customers with certificate replacement. It has also made Sectigo-issued certificates available as an alternative for customers. The effectiveness of these measures will depend on execution and on whether further findings change the assessment of residual risk.

Bottom Line

eMudhra’s exit removes its future direct exposure to the global SSL/TLS certificate business, which contributes about 1% of revenue. But the key-generation failure has raised a wider question about customer trust, despite the absence of reported data breaches and confirmed malicious exploitation in the public disclosures cited by CERT-In.

For investors, the next test is whether eMudhra can complete the certificate transition and investigation without lasting damage to customer relationships, overseas business or demand for its broader enterprise solutions. ICRA’s retained ratings offer context on the company’s rated credit facilities; they do not settle those outstanding questions.

Read Next: Kotak Bank Q2 FY27: Profit Rises 29.5%; NIM Slips; F&O Rollover 64.3%

Disclaimer: This article is for information only and is not investment advice.