eMudhra reports TLS key flaw; India DSC and eSign unaffected
- eMudhra confirmed a key generation flaw affecting 8 global TLS intermediate CAs
- Weak keys were published to browser root stores following an April 2025 ceremony
- India DSC and eSign businesses remain unaffected due to separate infrastructure
- The affected global TLS segment accounts for approximately 1% of total revenue
- No data breach or infrastructure compromise occurred; replacement certificates are being issued
*this image is generated using AI for illustrative purposes only.
eMudhra Limited stated on October 21, 2026, that a cryptographic flaw in its global Transport Layer Security (TLS) business has led to the distrust of select intermediate Certificate Authorities (CAs). The company confirmed that this incident does not compromise its Indian Digital Signature Certificate (DSC) and eSign operations, nor does it involve any data breach or infrastructure compromise.
The issue stems from a Key Generation Ceremony held on April 30, 2025, where a wrap/unwrap step error produced a second set of weak keys alongside the intended strong keys. These weak keys were subsequently published to browser root stores. An independent researcher recently identified that these keys could be reverse-engineered, potentially using AI-assisted techniques, and reported the finding to major root programs including Apple, Google, Microsoft, and Mozilla.
Impact on operations and revenue
The affected CAs are part of eMudhra’s global TLS business, which accounts for approximately 1% of the company’s total revenue. The company emphasized that the global TLS infrastructure is completely separate from the systems supporting its Indian DSC and eSign services. Consequently, digital signature services in India continue to operate normally without disruption.
| Aspect | Status | Details |
|---|---|---|
| Affected CAs | 8 Intermediate CAs | Created under ECC root in April 2025 |
| Revenue Impact | ~1% | Limited to global TLS business segment |
| India DSC/eSign | Unaffected | Separate infrastructure; services running normally |
| Security Breach | None | No data breach or infrastructure compromise |
Remediation and next steps
eMudhra is actively working with affected customers to provide replacement certificates to prevent service disruptions. The company is also engaging with the root programs to address the distrust issue and continues its investigation into the root cause of the key generation failure. While the direct financial impact is limited, the company acknowledged potential unquantifiable reputational risks.
What the numbers show
The disclosure highlights a critical divergence between operational scale and risk exposure. While the affected CAs were trusted in browser stores since mid-2025 and underwent independent audits for two consecutive years, the flaw originated from a procedural error in the 2025 Key Generation Ceremony rather than a runtime vulnerability. Furthermore, the isolation of the global TLS segment, representing only 1% of revenue, acts as a structural firewall, preventing a technical fault in a minor business line from cascading into the core Indian identity verification market.
Historical Stock Returns for eMudhra
| 1 Day | 5 Days | 1 Month | 6 Months | 1 Year | 5 Years |
|---|---|---|---|---|---|
| -20.00% | -22.20% | -29.58% | -13.64% | -33.49% | +67.51% |
How might the involvement of AI-assisted reverse-engineering techniques influence future industry standards for cryptographic key generation and audit protocols?
What specific regulatory or compliance adjustments will eMudhra need to implement to satisfy root program requirements before its intermediate CAs can regain trust?
Could this incident trigger a broader industry review of third-party certificate authority vetting processes, potentially increasing operational costs for all CA providers?
18
Access Market Heat-map & Insights 
Create, Save & Share your Screener 
Use 200+ Screening Filters 
