eMudhra has identified a cryptographic flaw that generated weak keys, potentially compromising its global TLS certificate business (AI-generated image used for representational purposes)
Because eMudhra is a major provider of Class 3 Digital Signature Certificates (DSCs) and USB tokens used by companies and tax professionals to sign documents and file GST returns and other registrations, the incident triggered online discussion.
The keys establish trust between websites and visitors’ browsers. eMudhra said it is working with potentially affected customers to issue replacement Transport Layer Security (TLS) certificates and avoid disrupting critical services. DSC and eSign services in India are running normally,” the company said. MUMBAI: Bengaluru-based digital trust and cybersecurity company eMudhra has acknowledged a cryptographic flaw that generated weak keys in its global website-certificate business, potentially exposing them to attackers. It is also coordinating with browser root programmes operated by Google, Apple, Microsoft and Mozilla to address the issue. The company has not disclosed a complete remediation timeline or a list of affected customers. However, the current incident concerns its global TLS website-certificate business, not its Indian DSC and eSign operations, which run on separate infrastructure. “This incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure that is completely separate from the India DSC business.
You Can Also Check: Gold Rate in Mumbai | Silver Rate in Mumbai | Bank Holidays in Mumbai | Public Holidays in Mumbai | Mumbai AQI | Weather in Mumbai | Petrol Price in Mumbai | Diesel Price in Mumbai | CNG Price in Mumbai | LPG Price in Mumbai Stay updated with the latest Mumbai news. Download the TOI App.
Shares of eMudhra fell 20% on the BSE following the news of the security flaw. The affected global TLS business accounts for around 1% of eMudhra’s revenue, the company said, while acknowledging that the reputational impact could not be quantified. The company is investigating how the flaw occurred, despite the affected certificate authorities having undergone independent audits for two consecutive years and being included in browser trust lists since mid-2025. Founded in 2008, eMudhra is a Bengaluru-based digital trust and cybersecurity company located at Hi-Tech Defence and Aerospace Park in Jala Hobli, Bengaluru, Karnataka.
“A flaw in the KGC (key generation ceremony) caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” eMudhra said in its filing. An independent researcher discovered last weekend that the weak keys could potentially be reverse-engineered, possibly using AI-assisted techniques, and alerted Apple, Google, Microsoft and Mozilla. eMudhra said its infrastructure had not been compromised, no data had been breached and its physical and logical security controls remained intact. These are the company’s assertions; the root-cause investigation is ongoing. The incident presents two potential risks: an attacker could use reconstructed keys to impersonate a website, while the withdrawal of browser trust could disrupt legitimate websites relying on affected certificate chains. There are also reports that Google may remove the eMudhra root certificate from Chrome’s trust store, potentially affecting websites that have not migrated to an accepted certificate chain. It provides digital trust and cybersecurity solutions for businesses. Its portfolio includes Public Key Infrastructure (PKI), digital signatures, SSL/TLS certificates, identity and access management, multifactor authentication, document signing and digital workflow platforms. The company also specialises in Zero Trust security, cryptography, paperless transformation and post-quantum cryptography.