Industry Odisha Bureau, Oct 23: A researcher has flagged weak keys in certificates issued by eMudhra. The company blames a technical flaw and denies any breach. MeitY has set up a special team to investigate.
Bengaluru-based eMudhra has triggered a red alert over internet security worldwide. A researcher found weak cryptographic keys in some of its website certificates. The company says the cause is a technical flaw, not a cyber breach.
The episode matters because of eMudhra’s unusual position. It is the only Indian certificate issuer trusted by major browsers worldwide. These include Google Chrome, Microsoft Edge, Apple Safari and Mozilla Firefox.
Venkatraman Srinivasan founded eMudhra in 2008. The firm offers digital identity verification, electronic signatures and paperless workflow services. Its digital signatures are used for income tax and provident fund filings.
eMudhra listed on 1 June 2022 through a ₹412.79-crore initial public offering. In FY26, it reported operating revenue of ₹701.6 crore. Net profit for the year stood at ₹110 crore.
The alarm was first raised on 17 October. An independent researcher posted concerns on Mozilla’s public incident tracker for browser security. The post suggested websites using eMudhra certificates could be exposed.
A digital certificate works like an online identity card for a website. It assures browsers that a site is genuine, not an imposter. Each certificate is tied to a secret key that should be nearly impossible to guess. Strong keys would take ordinary computers an extremely long time to crack.
The researcher’s findings indicated that some eMudhra keys were far weaker. In theory, weak keys could let attackers impersonate legitimate websites. Such impersonation could expose users to fraud on sites such as online banking. The report also questioned how much emphasis eMudhra placed on security.
eMudhra responded in a stock exchange filing on 21 October. It blamed a technical flaw for the weak keys and is establishing the root cause. The company said it had suffered no breach and controlled its security infrastructure. These remain the company’s own assessments.
eMudhra stressed that its global TLS business runs on separate infrastructure. TLS, or Transport Layer Security, is the technology behind secure website connections. Its Indian digital signature and eSign services, it said, continue to operate normally. It added that it had passed audits required by the major browsers.
The Ministry of Electronics and Information Technology has formed a special team to investigate. The ministry said it had taken serious note of the incident. It also indicated the impact falls on eMudhra’s global business, which it does not audit.
eMudhra estimated the revenue impact at about 1%, or roughly ₹7 crore. It warned of reputational risks that cannot be quantified. Investors reacted sharply, with shares down 37% since the disclosure at the time of reporting.
Separately, State Bank of India disclosed the exposure of data on 3,897 customers. No link between the two incidents has been established.
So far, no breach directly caused by the weak keys has been confirmed. Still, the episode shows how much online trust rests on certificate issuers. The investigation’s findings will be closely watched by users and investors.
