eMudhra is a Bengaluru-based company that helps people, businesses and governments establish identities and carry out transactions securely online. As of October 22, the company had a market capitalisation of about ₹2,700 crore. It had reported consolidated total income of ₹713 crore in FY26.
eMudhra’s best-known service in India is issuing Digital Signature Certificates (DSCs), which allow individuals and businesses to sign documents electronically. These are used for activities such as filing income-tax returns, GST-related work and signing contracts.
The company has also issued security certificates for websites and software. They help users establish whether they are communicating with the intended website or using software from a verified source.
Apart from these services, eMudhra provides software that businesses use to manage digital identities, control access to their systems and protect sensitive information. It operates in more than 35 countries.
2. What are digital certificates? Why are they important?
Think of a digital certificate as an identity card for a website, person or software publisher. For example, when someone visits their bank’s website, how does the browser know that it is communicating with the bank’s actual website and not an impersonator? This is where a digital certificate comes in. A trusted organisation, known as a Certificate Authority, issues a certificate that helps the browser verify the website’s identity.
These certificates also help establish an encrypted connection, meaning that information exchanged between the user and the website is protected from outsiders. That is why most websites begin with HTTPS rather than HTTP. The browser checks the certificate before establishing a secure connection. However, HTTPS alone does not guarantee that a website or business is genuine or trustworthy.
Without reliable digital certificates, users could be more easily tricked into sharing passwords, banking details and other sensitive information with impostors.
3. How did the security breach involving eMudhra unfold?
The problem began on April 30, 2025, when eMudhra was generating digital security keys for its international operations. According to eMudhra, an error in the computer script used to securely transfer the keys created a second set of much weaker keys, which were mistakenly published instead of the original strong ones. These keys belonged to eight intermediate certificate authorities, which operate under higher-level, trusted authorities known as root CAs.
The weakness remained undetected for nearly 18 months.
In October 2026, an independent security researcher discovered that the supposedly secret keys could be worked out almost instantly. This meant that someone could potentially create fraudulent certificates that appeared to have eMudhra’s approval.
The researcher alerted major technology companies, including Google and Mozilla. They quickly blocked the affected certificates to prevent their misuse. Google also announced plans to stop trusting a related root certificate authority on October 27, potentially affecting legitimate websites until they replace their certificates.
eMudhra says its computer infrastructure was not hacked and that no customer data was stolen. This was primarily a failure in creating secure keys, rather than a conventional data breach.
4. Does this incident change the outlook for eMudhra stock? Why is the stock facing the sharp sell off?
eMudhra shares have fallen about 36 per cent over two trading sessions through October 22. The sharp decline appears to reflect investor concerns over the security lapse, its possible impact on customer confidence and the company’s reputation.
However, eMudhra maintains that the affected global SSL/TLS certificate business accounts for only about 1 per cent of its revenue, while its Indian digital-signature and eSign operations remain unaffected.
On October 22, the company announced its decision to exit the global SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate business. These certificates help browsers verify the identity of websites and establish secure, encrypted connections, typically indicated by HTTPS in website addresses. eMudhra cited rising costs, competition and limited commercial potential for its decision.
Nevertheless, eMudhra has acknowledged that the incident could pose reputational risks that cannot currently be quantified.
With investigations still underway, the longer-term impact on its business and earnings remains uncertain. Much will depend on customer confidence, regulatory developments and whether the incident affects its other operations.
5. What are private keys? What was their role in this incident?
Imagine a government office issuing official documents using a special stamp. The public trusts the documents because only the authorised office is supposed to possess that stamp.
A private key works somewhat like this secret stamp in the digital world. It allows an authorised organisation to place a digital signature on a certificate. Anyone can check that signature using a corresponding public key, but they should not be able to reproduce it.
In eMudhra’s case, the private keys were generated so poorly that outsiders could easily figure them out.
It was almost like protecting a highly sensitive government stamp with a lock whose combination was just a single digit.
Someone who reconstructed these keys could potentially issue fake security certificates that appeared genuine. With the ability to intercept someone’s internet connection, an attacker might impersonate a banking or shopping website and steal information.
The weakness affected six certificate authorities used for websites and two used for software signing.
The compromised software-signing keys could also potentially allow malicious software to appear as though it came from a trusted source.
6. What are the key takeaways from the incident for users?
The most important point is that a serious security weakness does not necessarily mean users’ personal information has been stolen.
As of October 22, there is no confirmed evidence that attackers exploited the affected keys to steal information. Google also reported that the affected website-certificate authorities had not issued certificates recorded in public transparency logs before being blocked.
Importantly, eMudhra’s Indian digital-signature and eSign operations were not affected, according to the company and India’s cybersecurity agency, CERT-In.
Major browsers such as Chrome and Firefox have already introduced protections. However, some older software and applications may require separate security updates.
The incident also demonstrates that even organisations responsible for protecting internet communications can make serious mistakes. A failure by one trusted certificate issuer can potentially affect many websites and users.
7. What precautions should users take to protect themselves?
For ordinary internet users, there is no reason to panic or stop using online banking, shopping or government websites.
Nevertheless, some basic precautions are important.
1. Keep browsers and devices updated. Install updates for Chrome, Firefox, operating systems and other applications. Restarting an Android device can also help apply Google’s emergency protection.
2. Never ignore security warnings. If a browser says a website’s connection is not private or its certificate cannot be trusted, do not proceed or enter personal information.
3. Check website addresses carefully. Prefer typing the address of a bank or government website yourself instead of following unfamiliar links. Remember that even fraudulent websites can have HTTPS certificates.
4. Change passwords only if necessary. Users do not need to change their passwords simply because of this incident, unless they have other reasons to suspect their information was compromised.
For businesses and website operators, additional precautions may be necessary. They should update security-sensitive applications and check whether their websites use certificates linked to eMudhra’s affected root authority. If so, these certificates must be replaced with ones issued by a trusted authority to prevent service disruptions. eMudhra has said it will help affected customers obtain replacement certificates free of cost through its partners.
The broader lesson is simple. Online security depends not only on the precautions users take, but also on whether the organisations entrusted with protecting them maintain reliable safeguards.
Published on October 22, 2026
