eMudhra Crisis Explained: How Weak Security Keys Triggered A Govt Probe And Stock Selloff

The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the compromise of private keys associated with web security certificates issued by Bengaluru-based eMudhra, as the cybersecurity company’s shares fell sharply following the disclosure.

In a post on X, the ministry said it had taken “serious note” of the incident and was working with stakeholders to address the issue.

“Meity remains engaged with all the stakeholders to resolve this incident at the earliest. CERT-In has also issued an advisory in r/o the incident, including the mitigation measures,” the ministry said.

eMudhra shares fell 20% on Thursday and more than 36% over two consecutive trading sessions, settling at around ₹345.60 on Thursday, compared with ₹540 at Monday’s close.

What Is The eMudhra Security Certificate Issue?

The issue came to light after web browser company Mozilla published a report stating that private keys associated with eight eMudhra intermediate certificates had been compromised.

According to the Indian Computer Emergency Response Team (CERT-In), the private keys used for the digital certificates were “generated with insufficient cryptographic randomness”, resulting in their compromise.

The eight intermediate certificates were created on April 30, 2025. Their private keys were expected to use the P-384 elliptic curve cryptographic standard, but researchers found that the keys were single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237.

Since a single byte can represent only 256 possible values, researchers were able to recover all eight keys in less than a second.

CERT-In warned that attackers who recovered the keys could issue fraudulent certificates for domains they do not control. Such certificates could be used to impersonate legitimate websites and facilitate man-in-the-middle attacks, potentially enabling the interception or modification of encrypted communications if the affected certificate chains remained trusted by clients.

Apple, Google, Microsoft and Mozilla moved to block the affected certificates to prevent potential misuse.

Why Does The Internet Trust eMudhra?

Founded in 2008, eMudhra is an Indian digital trust and cybersecurity company that issues digital certificates and provides digital identity and authentication services. The company has issued more than 60 million digital certificates to date.

Digital certificates help web browsers verify whether a website is genuine and establish a secure, encrypted connection. Certificate Authorities, or CAs, issue these certificates and can also issue intermediate certificates, which provide another level of authority for issuing certificates to individual websites.

Browsers and other software rely on a global trust framework involving a limited number of certificate authorities to determine whether websites can be trusted.

A compromise involving intermediate certificates can therefore have implications beyond a single website. If misused, fraudulent certificates could allow attackers to impersonate legitimate services, including banking or shopping websites, and potentially expose sensitive information.

eMudhra Begins Investigation As MeitY Steps In

eMudhra said it had initiated its incident response procedures after becoming aware of the incident. It also said it had taken measures to contain the affected certificates and was working with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem.

“We are conducting a thorough investigation into the circumstances surrounding the incident and reviewing our security controls and operational procedures to identify and implement any necessary improvements,” the company said.

The company has also reassured investors that the affected business accounts for around 1% of its overall annual revenue. However, the government review and concerns over the reliability of its security systems have weighed on investor sentiment.

Why Have eMudhra Shares Fallen?

“The main reason for the decline was a disclosure regarding a weakness in eight technical security certificates used in its global internet security operations. These certificates help secure connections on the internet, and the technical issue led to the creation of weak digital security keys,” said Mayank Jain, Market Analyst, PhonePe Invest.

He said digital security companies rely heavily on trust and reliability, adding that investors were concerned about potential long-term damage to eMudhra’s brand and client confidence.

Adding to the pressure on the stock, the Ministry of Electronics and Information Technology (MeitY) stepped in to investigate the security issue alongside national cybersecurity authorities.

“While eMudhra reassured investors that the affected business accounts for only about 1% of its overall annual revenues, the market remains cautious while the government review takes place,” Jain said.