Indian Digital Certificate Firm eMudhra Under Scrutiny After Weak Security Keys Discovered

Security Flaw Discovered

Indian cybersecurity firm eMudhra faces intense scrutiny after an independent researcher found weak security keys in its website certificates on 17 October. Widespread disclosures came to light on 21 October regarding the firm, which is the only Indian issuer of digital certificates trusted by browsers worldwide.

Company Response and Impact

eMudhra stated that the weak keys resulted from a technical flaw rather than a breach, and the firm is working to find the root cause. The company stated that the impact on its revenue would be 1%, amounting to roughly 7 crore rupees based on FY26 earnings. However, the company also noted potential reputational risks that cannot be quantified at this stage.

Market Reaction

Following the incident, eMudhra's shares dropped by 37% as of press time, hitting a lower circuit on the BSE before trading 18.8% lower. Meanwhile, the State Bank of India reported that personally identifiable information of 3,897 users was disclosed online, though direct links between the data leak and eMudhra's weak keys have not been established.

Context

Digital certificates act as a fundamental building block of web security by encrypting data between users and websites. When a certifying authority issues weak cryptographic keys, it can potentially allow malicious actors to intercept or spoof secure connections.