eMudhra's board decided on 22 October 2026 to withdraw from the global SSL/TLS certificate business after eight of its issuing certificate authorities were found to use weak cryptographic keys, according to PTI via Deccan Herald. Its shares fell about 20% and hit the lower circuit at ₹345.25 on the BSE. Spectate Media has not seen the company's filing.
What was found
CyberScoop reports that a researcher alerted Apple, Google, Microsoft and Mozilla, and that security researcher Scott Helme then recovered all eight private keys in under a second. The keys were generated with too little randomness, so each could be worked out from its public certificate, and one was simply 4. eMudhra blamed an error in an April 2025 key generation ceremony that produced a second, weak set of keys that reached browser trust lists. The company says none of the eight intermediates issued certificates to websites, which has not been independently verified.
Response
Chrome and Firefox blocked the certificates within hours, according to CyberScoop, with Apple and Microsoft following, and Mozilla removed eMudhra's root from its trust list. Google plans to remove a root from Chrome. MeitY formed a special team to investigate, and CyberScoop says CERT-In had seen no malicious use of the keys as of Wednesday. The company says its infrastructure was not compromised and that digital signature and enterprise services are unaffected. The global SSL/TLS business is about 1% of revenue, per a co-founder reported elsewhere.
Reports differ
PTI puts the share fall at about 20% on Thursday, while CyberScoop says shares fell 40% over the two days after disclosure. Accounts differ on when the weakness was found and how long revocation took.
Key numbers
- Weak keys found: 8 (Intermediate certificate authorities)
- Time to recover keys: Under 1 second (Per CyberScoop)
- Global SSL/TLS share of revenue: About 1% (Per a co-founder)
- Share move, 22 October: About 20% lower (Lower circuit; 40% over two days per CyberScoop)
What boards and CFOs should note
Three points stand out. First, a small business line created a large reputational and market cost. Second, buyers of certificates need to check for replacements. Third, confirmation of the company's no-misuse claim should come from independent review.
Source: Deccan Herald (PTI), 22 October 2026. This is a summary of a news report, published as general information. It is not legal, tax or investment advice.
This article is journalism and commentary. It is not a recommendation to buy or sell any security, and it is not professional advice. Read the full disclaimer.
