Key Quantitative Figures

  • 8 intermediate Certificate Authorities (CAs) affected in the global TLS business
  • The affected business accounts for approximately 1% of the company's revenue
  • Key Generation Ceremony (KGC) was held on April 30, 2025
  • The roots and issuing CAs have been in browser trust lists since mid-2025
  • Company has over 17 years of expertise in digital identity solutions
  • Operates in more than 35 countries worldwide

Dates of Action

  • Key Generation Ceremony: April 30, 2025
  • Incident discovery: Last weekend (relative to October 21, 2026)
  • Press release date: October 21, 2026
  • Browser trust list inclusion: Mid-2025

Parties Involved

  • Independent researcher who discovered the vulnerability
  • Major root programs: Apple, Google, Microsoft, and Mozilla
  • Customers of eMudhra's global TLS business
  • Regulatory recipients: BSE Limited and National Stock Exchange of India Limited

Technical Details

The incident involves a flaw in the Key Generation Ceremony that caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were published to browser root stores. The keys were generated using FIPS 140-2 Level 3 Hardware Security Modules (HSMs). The weak keys could potentially be reverse-engineered using AI-assisted techniques.

Security Status Confirmation

eMudhra confirms that:

  • Its infrastructure was not compromised
  • No data was breached
  • All physical and logical security controls remained intact

Business Impact Assessment

The incident has:

  • No connection with eMudhra's Indian Digital Signature Certificate (DSC) and eSign businesses
  • No impact on India DSC business operations (services running normally)
  • The global TLS business runs on completely separate infrastructure from India DSC business
  • Limited commercial impact (approximately 1% of revenue)
  • Potential reputational risks that cannot be quantified

Response Actions

eMudhra is:

  • Working directly with affected customers to provide replacement certificates
  • Collaborating with root programs (Apple, Google, Microsoft, Mozilla)
  • Continuing root-cause investigation
  • Ensuring critical services are not disrupted

Company Background

eMudhra is a global provider of digital identity, trust, and security solutions serving banks and financial institutions (BFSI), enterprises, and governments. Product suite includes CertiNext (PKI and certificate lifecycle management), SecurePass (identity and access management, multi-factor authentication), and PrivaTrust (data discovery and consent management for global data-privacy compliance).