eMudhra Share Price Crashes 20% To Lower Circuit After Google, Mozilla Act On Security Certificates

eMudhra shares crashed 20% on Wednesday, October 21, after a security issue involving eight intermediate certificates in its global TLS business prompted Google and Mozilla to block the affected certificates.

The stock had closed at ₹540 in the previous session and opened lower at ₹520 on Wednesday. It briefly rose to an intraday high of ₹524.90 before selling intensified, dragging the stock to ₹432, where it hit the 20% lower circuit.

Google said the keys had been generated with insufficient randomness, making it possible for them to be compromised. Such keys could potentially be used to create fraudulent HTTPS certificates and impersonate websites on systems that continued to trust the affected certificates.

Mozilla has blocked the affected certificates in Firefox, while Google has also blocked them for Chrome users and is removing the root certificate that signed the affected intermediates from the Chrome Root Store.

eMudhra, however, said its infrastructure was not compromised and no data was breached. The company also clarified that the incident is separate from its Indian Digital Signature Certificate and eSign businesses, which continue to operate normally.

Why Is eMudhra Share Price Falling Today?

eMudhra shares came under heavy selling pressure after details of the certificate security incident raised concerns over its global TLS business and potential reputational impact. The company has said the affected business contributes only around 1% of its revenue.

• Eight certificates affected: Private keys associated with eight eMudhra intermediate CA certificates were found to be compromised. The certificates were part of the company's global TLS operations.

• Google and Mozilla acted: Google blocked the affected intermediate CAs for Chrome users, while Mozilla blocked them through Firefox. Google is also removing the root certificate that signed the affected intermediates from its Chrome Root Store.

• Website impersonation risk: Google said the weak private keys could potentially allow forged trusted HTTPS certificates to be created, which could be used to impersonate websites on systems that had not stopped trusting the affected CAs.

• Reputational risk: eMudhra said the affected global TLS business contributes around 1% of its revenue but acknowledged that the incident could carry reputational risks that cannot currently be quantified.

The company said its infrastructure was not compromised, no data was breached and its physical and logical security controls remained intact.

What Happened With eMudhra Security Certificates?

The incident involves eight intermediate CAs created under eMudhra's ECC root as part of a Key Generation Ceremony conducted in April 2025.

According to eMudhra, the issue was limited to this specific set of intermediate certificates. The company said none of the affected intermediate CAs were deployed in production except one, and none of them, including the one deployed in production, had issued end-user certificates.

Google said it received a report from a security researcher on October 17 about compromised private keys associated with the eight certificates. It subsequently verified the findings and blocked the affected keys for Chrome users.

Mozilla separately said it received a report about the compromised private keys on October 17 and blocked the affected certificates in Firefox through OneCRL. It has also released Firefox updates and is removing the root certificate that signed the affected intermediates from its trusted certificate list.

eMudhra said it has started an investigation into the circumstances surrounding the incident and is reviewing its security controls and operational procedures.

eMudhra Says India DSC And eSign Businesses Unaffected

The security incident has no connection with its Indian Digital Signature Certificate and eSign businesses, the company noted. The global TLS operation runs on infrastructure separate from the company's India DSC business, and its DSC and eSign services in the country continue to operate normally.

The company said the affected global TLS operations account for around 1% of its revenue. It is working with potentially affected customers to provide replacement certificates and is coordinating with browser and root-store operators while its investigation continues.

Wednesday's sell-off pushed eMudhra shares to ₹432 on the NSE, down 20% from the previous close of ₹540, after the security certificate incident triggered action from major browser operators.

Also Read - Adani Green Energy Q2 FY27 Earnings: Revenue Reaches ₹4,019 Crore As EBITDA Rises 51% In September Quarter