Shares of eMudhra plunged 20 percent on Wednesday, October 21, hitting the lower circuit as investors reacted to a security flaw that left eight of the company’s intermediate certificate authorities with weak private keys. The eMudhra share price fell 108 points to Rs 432 on the BSE, in the stock’s sharpest single-day retreat since its listing.
With the latest fall, the eMudhra share price trades roughly 58 percent below its peak of Rs 1,024 recorded in December 2024. The selling followed revelations that a flaw in the company’s key-generation process had generated weak cryptographic keys alongside secure ones, potentially allowing attackers to impersonate legitimate websites.
Digital certificates let a browser check whether a site is genuine, and eMudhra is among the certifying authorities licensed by India’s Controller of Certifying Authorities.
What pushed the eMudhra share price down 20%
The issue came to light on October 17, when a security researcher alerted Mozilla to an exposure affecting the private keys of eight eMudhra intermediate certificates. Mozilla cryptography engineer Dennis Jackson reported the problem, flagging insufficient randomness that made the keys vulnerable to recovery. An independent researcher separately reported the issue to the browser root programmes run by Apple, Google, Microsoft and Mozilla.
Six of the eight affected certificates were for website connections over HTTPS, and the remaining two were for verifying software publishers through code signing. Because cryptographic keys authenticate the issuing body, unauthorized access could theoretically let attackers forge valid credentials to impersonate banks, email providers and government services online.
The eMudhra share price fell as Google, Mozilla, Apple and Microsoft moved to block the affected certificates, setting off emergency fixes across browsers, applications and enterprise systems. Inc42 reported that a private key meant to vouch for the security of websites around the world was found to be the number 4, an example of how weak the generation process had been. The scale of the browser distrust is what drove the eMudhra share price down so sharply. Investigators have confirmed that no fraudulent certificates derived from the compromised keys have been identified in public logs.
How the weak keys happened
The flaw occurred during a key-generation ceremony on April 30, 2025, when a second set of weak keys was generated alongside the original strong keys and then published to browser root stores.
In a statement on its website dated October 20, eMudhra said the incident does not affect its root CA private keys or its other intermediate certificate authorities. Only one of the eight intermediates had been deployed in production, the company said, and none of the eight had issued any end-entity certificate. It is giving affected customers replacement certificates and continuing its root-cause investigation with the root programmes.
The company also said its digital signature certificate and eSign services in India continue to function normally and ruled out a data breach.
The eMudhra share price crash and the 1% revenue question
The financial hit behind the eMudhra share price fall looks limited to the global website-certificate business, which eMudhra said accounts for around 1 percent of its revenue. The company reported FY26 revenue of about Rs 710 crore and EBITDA of roughly Rs 110 crore, and had guided for revenue growth of 15 to 18 percent, with greater emphasis on higher-margin enterprise solutions.
The market’s verdict on the eMudhra share price was harsher than the numbers suggest, because the incident raises questions about oversight in a business built on trust. The company’s Indian digital signature and eSign services are regulated by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology and are unaffected, senior ministry officials said. They said the certificates trusted by browsers and operating systems are an international business that runs under the global trust framework, and that the impact on Indian websites and applications has been very limited and for a very short period.
Regulators step in after the eMudhra share price fall
The eMudhra share price ended the session at the 20 percent lower circuit as news of a ministry probe spread. India’s Ministry of Electronics and Information Technology has formed a special team to investigate the incident, senior ministry officials said on October 21, according to ThePrint. The officials said the ministry is in contact with everyone involved and will share more once the investigation is complete.
CERT-In published advisory CIAD-2026-0050 on October 21, saying the public disclosures do not establish confirmed malicious use of the keys as of that date. It warns that removing emSign ECC Root CA – G3 from trust stores could disrupt legitimate sites, and tells administrators to replace certificates that chain to the root where their clients will stop trusting it.