eMudhra has issued a statement regarding a security flaw affecting 8 of its intermediate Certificate Authorities (CAs) used in its global TLS business. The issue stems from a Key Generation Ceremony flaw that resulted in weak keys being published to browser root stores. eMudhra confirms no infrastructure compromise or data breach occurred and that its Indian DSC and eSign businesses remain unaffected. The company is working with affected customers and root programs to resolve the matter.
eMudhra Addresses Global TLS Security Vulnerability
eMudhra Limited released a statement on October 21, 2026, addressing recent reports concerning a distrust of some of its intermediate Certificate Authorities (CAs) within its global TLS business. The issue affects 8 intermediate CAs that were part of eMudhra’s Global TLS operations. These CAs were generated using an ECC root during a Key Generation Ceremony (KGC) on April 30, 2025, employing FIPS 140-2 Level 3 Hardware Security Modules (HSMs).
Root Cause and Impact
A flaw identified in the KGC process led to the generation of a second set of weak keys alongside the original strong keys. These weak keys were inadvertently published to browser root stores. An independent researcher identified that these weak keys could potentially be reverse-engineered, possibly with AI-assisted techniques, and reported this to major root programs including Apple, Google, Microsoft, and Mozilla.
Assurances on Security and Operations
eMudhra has emphatically confirmed that its infrastructure was not compromised, and no data was breached. All physical and logical security controls are reported to have remained intact throughout the incident. Importantly, the company states there is no impact on its Indian Digital Signature Certificate (DSC) and eSign businesses, as the global TLS business operates on a completely separate infrastructure. DSC and eSign services in India are functioning normally.
Commercial Implications and Next Steps
The affected global TLS business represents a small portion of eMudhra’s operations, contributing approximately 1% of the company’s revenue. While direct financial impact is limited, the company acknowledges potential reputational risks that are difficult to quantify. eMudhra is actively engaging with affected customers to provide replacement certificates and is collaborating with the root programs to address the issue. A root-cause investigation is ongoing.
About eMudhra
eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks, financial institutions, enterprises, and governments across over 35 countries. Its offerings include CertiNext for PKI and certificate lifecycle management, SecurePass for identity and access management, and PrivaTrust for data privacy compliance.
Source: BSE
