eMudhra shares were locked in a 20% lower circuit on Wednesday after the company issued a statement addressing recent reports of distrust in some of its intermediate Certificate Authorities (CAs) used in its global Transport Layer Security (TLS) business.
The issue involves eight of eMudhra’s intermediate CAs that were trusted as part of its global TLS business. These issuing CAs were created under the company’s ECC root during a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).
According to eMudhra, a flaw in the key generation process caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were subsequently published to browser root stores. The company said it is working to establish the root cause of the issue.
The affected roots and issuing CAs had undergone independent audits for two consecutive years and had been included in browser trust lists since mid-2025.
Over the past weekend, an independent researcher discovered that the weak keys could potentially be reverse-engineered, possibly with the assistance of artificial intelligence (AI). The researcher reported the findings to major root programs operated by Apple, Google, Microsoft and Mozilla.