New Delhi: Shares of eMudhra Ltd fell 20% — down 108 points to Rs 432 on the NSE at 11:46 am on Wednesday — hitting the lower circuit after the digital-authentication company disclosed a flaw affecting eight of its global TLS intermediate certificate authorities (CAs), The Hindu BusinessLine reported.

In its statement, issued on October 21, eMudhra said the eight issuing CAs were created under its ECC root in a Key Generation Ceremony (KGC) held on April 30, 2025, and that a flaw in a wrap/unwrap step in that ceremony produced a second set of weak keys alongside the original strong keys; the weak keys were the ones published to browser root stores. The company said it is working to establish the root cause.

The issue came to light after an independent researcher discovered on October 17 that the weak keys could potentially be reverse-engineered, possibly using AI-assisted techniques, and reported it to the major browser root programmes operated by Apple, Google, Microsoft and Mozilla, BusinessLine reported. Mozilla has blocked the affected certificates in Firefox through its OneCRL revocation list, according to reports summarising Mozilla's post.

eMudhra stated that its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact. It said the incident has no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses, which run on completely separate infrastructure and are functioning normally. The affected global TLS business accounts for around 1% of the company's revenue, though the company acknowledged reputational risks that cannot be quantified, BusinessLine reported. The company said it is working directly with potentially affected customers to provide replacement certificates and is coordinating with browser root programmes while its investigation continues. India's cybersecurity authority CERT-In had yet to weigh in on the issue at the time of BusinessLine's report.

Sources: The Hindu BusinessLine, eMudhra company statement via EIN Presswire, 7Globe (CNBC-TV18 summary).