eMudhra shares fall 17% as MeitY probes PKI security incident; here’s what happened

Shares of eMudhra Ltd fell nearly 17% in Thursday’s trade as investors continued to react to a security incident involving the company’s Public Key Infrastructure (PKI) business. The stock was trading at ₹358.85, down 16.93%, at the time of reporting. It touched an intraday low of ₹346, against an opening price of ₹385. The stock had already fallen 20% on Wednesday, closing at ₹432.

The sharp fall comes after the Ministry of Electronics and Information Technology (MeitY) said it had taken “serious note” of a reported security incident involving eMudhra’s PKI infrastructure and constituted a special team to investigate the matter.

The incident concerns eight intermediate Certificate Authority (CA) certificates used in eMudhra’s global TLS business. These certificates are part of the infrastructure that helps browsers establish whether a website is genuine and whether an encrypted connection can be trusted.

According to eMudhra, the affected certificates were created during a key generation ceremony on April 30, 2025. A flaw in the key-generation process resulted in a second set of weak private keys being generated alongside the intended keys. The company said these weak keys were subsequently published to browser root stores.

CERT-In said the affected P-384 private keys had insufficient cryptographic randomness and could be recovered almost instantly from their corresponding public keys. If recovered, the keys could potentially be used to issue fraudulent certificates for domains controlled by someone else, allowing attackers to impersonate legitimate websites or potentially carry out man-in-the-middle attacks.

Google and Mozilla moved to block the affected certificates after the issue was reported by an independent security researcher on October 17. Google said it found no TLS certificates chaining to the six affected intermediate CAs in Certificate Transparency logs before its blocking action.

MeitY says Indian digital signature, eSign services unaffected

MeitY clarified that the incident is limited to eMudhra’s international certificate business and does not affect its Indian Digital Signature Certificate (DSC) and eSign services.

“eMudhra operates in two distinct areas,” the ministry said. The first is the issuance of Digital Signature Certificates and eSign services, which are regulated by the Controller of Certifying Authorities under MeitY. The second involves the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications.

“The reported security incident pertains to this only,” MeitY said, referring to the second business.

The ministry added that the global certificate business operates under an international trust framework and is subject to independent audits, including WebTrust audits by BDO International Limited. “MeitY is not involved in its audit,” it said.

MeitY also said the impact on Indian websites and applications had been “very limited and for a very short interval”. It said CERT-In had issued an advisory on the incident, including mitigation measures.

eMudhra has said its infrastructure was not compromised and that there was no data breach. It also said none of the affected intermediate CAs had issued end-entity certificates, while only one of the eight had been deployed in production. The company said the affected global TLS business accounts for around 1% of its revenue, although the reputational impact remains difficult to quantify.

MeitY said it remains engaged with stakeholders to resolve the matter. “Further details will be shared upon completion of the investigation,” the ministry said.