eMudhra share price movement

Share price of eMudhra slumped 20 per cent for the second straight day, hitting a 52-week low at ₹345.25 on the BSE in Thursday’s intraday deals after the Ministry of Electronics and Information Technology (MeitY) formed a special team to investigate the leak of private keys associated with web security certificates issued by the company.

In the past two trading days, the market price of eMudhra tanked 36 per cent amid reports of distrust of some of its intermediate Certificate Authorities (CAs) used in its global TLS business.

The stock crashed below its previous low of ₹365.75 touched on March 30, 2026. At 02:56 PM, eMudhra quoted 19 per cent lower at ₹348.05 on the BSE, as compared to 0.66 per cent decline in the BSE Sensex. A combined 9.06 million shares changed hands on the NSE and BSE.

Govt forms special team to investigate eMudhra digital certificate leak

According to a Business Standard report, the Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the leak of private keys associated with web security certificates issued by eMudhra.

On Wednesday, the Indian Computer Emergency Response Team (CERT-In) issued an advisory cautioning that private keys used for eMudhra’s digital certificates had been “generated with insufficient cryptographic randomness,” leading to their compromise.

The issue came to light after web browser company Mozilla published a report stating that private keys associated with eight eMudhra intermediate certificates had been compromised, the Business Standard reported. READ MORE

eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI), enterprises, and governments across more than 35 countries worldwide.

Founded in 2008, eMudhra has issued more than 60 million digital certificates to date.

A limited number of certificate authorities (CAs) worldwide issue digital certificates under a global trust framework. Based on certificates issued by such authorities, web browsers determine whether a website can be trusted and establish secure connections.

Meanwhile, eMudhra said in an exchange filing on Wednesday that the matter concerns 8 of eMudhra’s several intermediate CAs trusted as part of its Global TLS business. These issuing CAs were created under eMudhra’s ECC root in a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).

A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause, the company said in a press release.

These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025.

Last weekend, an independent researcher found that the weak keys could possibly be reverse-engineered with AI-assisted techniques. The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla, the company said.

Meanwhile, eMudhra confirms that its infrastructure was not compromised. No data was breached and all physical and logical security controls remained intact.

The affected global TLS business is a very small part of eMudhra’s operations, accounting for around 1 per cent of the company’s revenue. However, this may cause some reputational risks for eMudhra, which cannot be quantified, the company said.

eMudhra said it is working directly with affected customers to provide replacement certificates so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation.