A new wave of cybersecurity concerns is sweeping across India as researchers found that eight digital certificates issued by the Bengaluru-based cybersecurity company eMudhra were protected by extremely weak secret keys. Google, Apple, Microsoft and Mozilla have blocked the concerned certificates following the incident.
Though eMudhra confirmed there was no data breach, and that all physical and logical security controls remain intact, the company’s shares crashed by more than 36 per cent in two consecutive trading sessions after the controversy. Share prices settled at about ₹345 on Thursday from a closing price of ₹540 on Monday.
But the highlight is that the incident affected a business that contributes only around 1 per cent of eMudhra’s total revenue. Why has this seemingly insignificant part of the business triggered such a sharp reaction in the stock market?
eMudhra is an Indian digital cybersecurity company that helps banks, businesses and government organisations verify digital identities, sign documents and secure online communications. One of the company’s services involves issuing digital certificates that help internet browsers identify genuine websites. These certificates depend on long passwords or secure digital keys. Access to the secret key allows someone to generate a certificate on their own.
Eight of eMudhra’s certificates were found to have weak secret keys. Typically, these keys are complicated random numbers. However, a researcher found that the keys for these certificates were tiny, easy numbers. They were single-digit numbers like 4, and other numbers like 56, 66, 115, 155, 156, 230 as keys. Researchers were able to generate all the keys in less than a second. They informed the problem to the browser companies including Apple, Google, Microsoft and Mozilla on October 17.
The company explained that the certificates in question were generated during a Key Generation Ceremony (KGC) on April 30, 2025. A flaw in the KGC caused the production of a second set of weak keys alongside the original strong keys. But the weak keys were still published to browser root stores.
“eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation,” eMudhra’s statement read.
The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the leak. The ministry wrote on X, “MeitY has taken serious note of the reported incident. A special team has been constituted to investigate the matter.”
Are your DSCs affected?
According to eMudhra’s regulatory filing, the incident has only affected it's global TLS business and has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses.
“The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally,” the company stressed.
