In today’s Finshots, we tell you what went wrong at eMudhra.

But here’s a quick sidenote before we begin. Your CTC includes health insurance, but not peace of mind.

Most employees assume their company has them covered, until they realise corporate plans have low limits, no life cover, and vanish the day they resign. There’s a whole side of insurance your employer is never going to take care of.

Our 2-day Insurance Masterclass will show you exactly what that looks like and how to fix it.

📅 Saturday (tomorrow), 24th October at 11:00 AM: Life Insurance
📅 Sunday, 25th October at 11:00 AM: Health Insurance

Only few seats left 👉🏽 Click here to save your spot.

Now, on to today’s story.

The Story

When you visit a website, you’ll notice a padlock and HTTPS in your browser’s address bar. This means your connection is encrypted, so anyone trying to intercept the data you exchange with the website can’t easily read it. The technology that makes this possible is called Transport Layer Security (TLS). It also helps your browser check whether the website is genuine.

To understand how, let’s assume you’re logging in to your bank’s website. For the bank to prove its identity to your browser, it needs something called a digital certificate, which is kind of like its identity card. This certificate is issued by a company called a certificate authority (CA). One such company is eMudhra, the protagonist of today’s story. Your browser then checks whether the certificate is valid and whether it can trace it back to an authority it trusts. If these checks pass, the browser can establish a secure connection.

But there’s a bit of nuance here. CAs work in a sort of hierarchy. At the top are root CAs, which are trusted by browsers. They can authorise lower-level intermediate CAs, which can then issue certificates to websites. So, your browser doesn’t necessarily need to trust the company that directly issued the website’s certificate. It needs to be able to trace that certificate back to a trusted root CA.

And to authenticate the digital certificate CAs use private keys. These keys are long numbers that are designed to be so difficult to guess that forging a signature without the right key is practically impossible. But if someone steals a private key, they could potentially use it to create fake certificates that appear trustworthy.

For instance, an attacker can create a fake certificate for a website that looks exactly like your bank’s. If they can also intercept your connection and get past your browser’s security checks, you could be tricked into handing over your login details and other sensitive information.

Something similar has happened with eMudhra’s intermediate certificates. Basically, the private keys used to sign these certificates need to be sufficiently strong. In this case, they were supposed to use the P-384 elliptic curve, which provides roughly 10 to the power 115 possible private key combinations. But apparently, a few of eMudhra’s certificates had private keys so weak that they offered just 256 possible number combinations. While 256 might seem like a lot to you and me, a computer could check all those possibilities in a fraction of a second. And although there’s no evidence that anyone exploited these weak keys, the flaw could have allowed attackers to create fraudulent certificates and potentially impersonate trusted websites. That’s why companies like Google, Microsoft and Mozilla have taken steps to block the affected certificates.

Now, the obvious question is how did a company that sells digital trust end up with such weak keys? Honestly, we don’t know yet. But it appears that last year, eMudhra generated a new set of intermediate certificates through a formal process called a key generation ceremony. 8 of the 24 certificates generated in that batch were affected.

Something went wrong during this process, resulting in weak keys being generated along with the strong ones and the weak ones were the ones shared with the browser makers’ trust lists. But the exact cause still isn’t known and eMudhra will eventually figure that out when it comes up with a root cause report on this.

Meanwhile, it’s actually worth understanding how something like this affects eMudhra’s business. Because as you’ve seen its stock has crashed and dropped to its 52 week low after the incident came to light and the government ordered a security probe. To put that in perspective, that erased nearly ₹1,000 crore from its market value.

But to understand that we’ll first need to look at eMudhra’s underlying business.

eMudhra started out in 2008 by issuing digital signature certificates (DSCs). But over time, it grew into a digital trust and cybersecurity solutions provider. It launched paperless office software called emSigner and eventually became a globally recognised root certificate authority (CA).

Today, it makes money in three ways:

1. Enterprise software for large organisations: This is its growth engine. eMudhra builds software that helps organisations sign documents digitally, manage thousands of certificates and control who can log in to their systems. Banks, governments and large companies pay for these products and renew their contracts. So this is a largely recurring business and it accounts for roughly 65% of eMudhra’s revenue.
2. Trust services, or its original business: This mainly includes digital signature certificates (DSCs) in India, along with website TLS certificates. It accounts for about 15% of the company’s revenue. But this business has been facing pressure for three reasons.
   
   To begin with, a regulatory change in 2024 forced eMudhra to change its sales model. Earlier, it billed partners who then resold its products to customers. Second, digital signatures became optional for non-corporate taxpayers subject to tax audits. This reduced the number of customers who needed to buy them. And third, eMudhra earned less from its digital trust services in the latest quarter because customers bought fewer older hardware tokens. These tokens store digital certificates and help people sign documents securely online. But with the industry moving to a newer security standard in September, customers held off on buying older tokens while waiting for newer ones.
3. Consulting and product integration services: This mainly involves distributing and integrating enterprise products in North America, and accounts for the remaining revenue.

In FY26, eMudhra earned ₹713 crore in total income from all these sources and made ₹110 crore in profit. In Q1FY27, it earned ₹192 crore in total income and ₹32 crore in profit. Both figures grew by close to 28% year-on-year. And if you look at this revenue mix, you’ll notice that much of eMudhra’s business doesn’t depend on browsers trusting its certificates.

What has actually been affected is its TLS business. The immediate impact could be on about 1% of its global business because around 30,000 customer certificates belonging to a US customer group may need to be replaced.

Its Indian digital signature services on the other hand run on separate systems. So nothing really changes there as some of its enterprise products, such as private trust systems built for banks, don't depend on browsers' lists of trusted authorities.

For example, in its own words, one of India’s largest commercial banks (we don’t know which one) uses eMudhra’s software to track digital certificates. It also uses eMudhra’s technology to run its own private certificate authority. This allows the bank to issue certificates for its internal systems and decide which certificates its own computers trust.

In other words, these are private systems where the organisation decides whom to trust. That’s different from public websites, where trust depends on browsers recognising CAs. So even if browsers stop trusting eMudhra’s public certificates, the bank’s internal systems could continue working.

The catch, though, is that these customers might still reconsider using eMudhra’s products if this incident shakes their confidence in the company. After all, banks and governments trust eMudhra to manage their digital keys securely, and this failure involved precisely that. But it’s difficult to put a number on the potential damage to its reputation.

So yeah, right now that’s where things stand with the eMudhra incident. And since deals with banks and governments often take a lot of time to close, we’ll know whether these concerns actually hurt eMudhra’s business only when the impact starts actually showing up in its results.

Until then…

Don’t forget to share this story on WhatsApp, LinkedIn, and X.

And if you’re someone who loves keeping tabs on the world of business and finance, hit subscribe if you haven’t already. And if you’re already a subscriber, thank you! Maybe forward this to someone who’d enjoy our stories but hasn’t discovered us yet.