Shares of digital certification company eMudhra plunged nearly 20 per cent to a 52-week low on Thursday, extending their fall to about 34 per cent in three sessions, after the government ordered a security probe into a certificate incident at the company. On the NSE, the stock tumbled 19.91 per cent to Rs 346 apiece, while on the BSE it tanked 19.63 per cent to Rs 346.85, PTI reported.
Source: PTI via The Hindu BusinessLine
The selloff followed a CERT-In advisory after eMudhra reported that private keys associated with eight intermediate Certificate Authority (CA) certificates in its public key infrastructure had been compromised. The Ministry of Electronics and Information Technology (MeitY) said on Wednesday it had constituted a special team to investigate the incident, and that the impact on Indian websites and applications was "very limited" and lasted a short interval.
Source: Livemint
In an exchange filing on October 21, eMudhra said a flaw in its key generation component caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys, and the weak keys were published to browser root stores. The company said its infrastructure was not compromised, there was no data breach, and its Indian Digital Signature Certificate (DSC) and eSign businesses — which run on separate infrastructure — are operating normally. The affected global TLS business accounts for around 1 per cent of revenue, it said, while flagging reputational risk.
Source: Livemint
A senior company official said weak keys were created by eight out of 40 certifying authorities but were never put to commercial use. "There's no impact to subscribers because we have done all the actions," eMudhra co-founder Kaushik Srinivasan told PTI, adding the company is working with customers to notify them that there is no impact because no certificates were issued. Management also called the incident a "one-off incident on a bad day" in an interaction with CNBC-TV18.
Source: CNBC-TV18
eMudhra issues digital signature and website security certificates that help browsers confirm a website is genuine. The company said it is providing replacement certificates to customers who may be affected and continues its root-cause investigation with the browser root programmes.
Thursday: eMudhra fell 19.91% on the NSE to Rs 346 — a 52-week low — taking its three-session fall to about 34% (yaani: roughly one-third of the stock's value wiped out in three days). Trigger: CERT-In advisory over compromised private keys linked to 8 intermediate CA certificates; MeitY has set up a special probe team.