eMudhra shares crash another 4%, down 40% in 3 sessions. What's behind this free fall?

The reported share fall reflects investor concern about the certificate-security incident and its possible business consequences. eMudhra disclosed compromised private keys linked to eight intermediate CAs. It also acknowledged reputational risks whose extent could not be quantified. Such uncertainty can weigh heavily on a share price.

The global SSL/TLS business attracted social media attention and scrutiny, even though it contributed about 1% of global revenue. The company said no end-entity certificates had been issued by the affected CAs, its infrastructure was not compromised, and no data was breached. Still, the incident involved browser-trusted certificates, making it highly visible.

The board then decided to exit the global SSL/TLS certificate business. eMudhra said data-sovereignty costs, compliance complexity, and free certificates had already reduced the segment's potential and returns. Together, the incident, reputational uncertainty, and exit decision help explain the reported fall, though the article does not quantify each factor's individual effect.

The private keys associated with eight intermediate CA certificates were compromised because the key-generation process produced a second, weak set of keys. eMudhra said a flaw in a wrap/unwrap step caused these weak keys to appear alongside the original strong keys. The weak keys were then published to browser root stores.

The problem was discovered when an independent researcher found that the weak keys could be reverse-engineered, possibly using AI-assisted techniques. The researcher reported the finding to Apple, Google, Microsoft, and Mozilla root programs. These programs help determine which certificate authorities browsers and operating systems trust.

The incident did not mean eMudhra's infrastructure was compromised, according to the company. It said no data was breached and security controls remained intact. The affected CAs were revoked within 14 hours of discovery. eMudhra also worked with potentially affected customers to provide replacement certificates and continued investigating the root cause.

An SSL/TLS certificate is a digital credential that helps identify a website and supports an encrypted connection between the site and a user's browser. A Certificate Authority, or CA, issues or signs that certificate. The CA's role matters because browsers and operating systems maintain lists of trusted certificate issuers.

When a browser visits a secure website, it checks whether the site's certificate is valid, matches the website, and connects through a trusted CA. It also checks cryptographic signatures and whether the certificate has been revoked or expired. If those checks succeed, the browser can display the connection as trusted. If they fail, it can warn the user.

The article describes eMudhra's global PKI as establishing trust in digital certificates and securing online connections. Its affected certificates were trusted by major browsers and operating systems. Because weak keys were published to browser root stores, the incident required CA revocation and replacement certificates for customers who might be affected.

eMudhra's global SSL/TLS certificate business was a small part of the company, contributing about 1% of global revenue. This figure put the incident in perspective: the segment had broad browser visibility but limited financial weight within the overall business.

The company said the segment had also become harder and costlier to operate. Rising data-sovereignty and compliance requirements increased complexity. Free SSL/TLS certificates offered by some large entities reduced the segment's business potential and return on investment. These pressures existed before the company considered its response to the security incident.

After detailed deliberations, the board concluded that exiting the global SSL/TLS certificate business was right for eMudhra and its shareholders. The company said social media attention and scrutiny were disproportionate to the segment's revenue contribution. Its separate India-regulated digital-signature and eSign services remained unaffected, according to MeitY.

A CA's private key is central to signing or authorising digital certificates. If that key is compromised, an attacker may be able to create or validate certificates that browsers and operating systems would otherwise trust. That can weaken confidence in the identity and security of affected online services.

Revocation is the defensive response. The CA or root programs withdraw trust from the affected authority or certificates. Browsers and other software can then reject connections using them or display warnings. Customers may need replacement certificates so websites, software, and communications continue operating normally.

In eMudhra's case, eight intermediate CA certificates were involved. The company said no end-entity certificates had been issued by the affected CAs, and the impact on Indian websites and applications was very limited and brief. It revoked the affected CAs within 14 hours and worked directly with potentially affected customers on replacements.

The global SSL/TLS business provides digital certificates trusted by major browsers and operating systems. These certificates secure websites, software, and online communications. The affected eight certificates belonged to this global PKI, which establishes trust for online connections.

The other business covers Digital Signature Certificate and eSign services in India. It is regulated by the Controller of Certifying Authorities under MeitY. MeitY specifically said these services remained unaffected. This distinction matters because the incident involved eMudhra's browser-trusted global certificate infrastructure, not the company's India-regulated DSC and eSign operations.

MeitY said the impact on Indian websites and applications was very limited and lasted for a very short interval. Separately, eMudhra's chairman said the global SSL/TLS business contributed about 1% of global revenue. After reviewing the incident and the segment's costs and prospects, the board decided to exit that global business.

Public-key infrastructure, or PKI, is the framework behind digital certificates. It links an online service to a certificate and then to a Certificate Authority trusted by browsers and operating systems. This chain gives a user's device a basis for deciding whether the service's claimed identity is trustworthy.

The mechanism uses cryptographic keys. A service has a public key in its certificate and a corresponding private key. A CA signs the certificate, and the browser checks that signature against the CA's trusted information. It also checks the website name, validity period, and revocation status. If the checks pass, the device can establish a secure connection using the certificate.

The article says eMudhra's global PKI establishes trust in certificates and secures online connections. In this incident, weak keys were published to browser root stores, so the affected CAs were revoked. The company then worked with customers on replacement certificates while investigating the key-generation flaw.