eMudhra\u2019s decision to exit its global website security certificate business raises a question for those tracking the eMudhra share price that goes beyond the immediate headline: how should investors assess a security incident at a company whose business depends on digital trust?<\/p>\n\n\n\n
The company announced its withdrawal from the global SSL\/TLS certificate business on 22 October 2026, following the discovery of weak private keys associated with eight intermediate certificate authorities. eMudhra says this business contributes approximately 1% of its global revenue, while its Indian digital signature and eSign services remain unaffected.<\/p>\n\n\n\n
For shareholders, the challenge is separating the revenue directly exposed to the exit from the possible consequences for customer confidence, costs and future growth.<\/p>\n\n\n\n
According to eMudhra\u2019s initial explanation, the problem originated during a key-generation ceremony on 30 April 2025. A flaw in a wrap\/unwrap step generated weak cryptographic keys alongside the intended strong keys. The weak keys subsequently became associated with certificates trusted by browser systems.<\/p>\n\n\n\n
The company said an independent researcher identified the weakness and alerted major browser root programmes. It also acknowledged reputational risks that could not be quantified at that stage.<\/p>\n\n\n\n
This distinction matters: a cryptographic weakness can create serious security risks even when there is no confirmed intrusion into the issuing company\u2019s infrastructure.<\/p>\n\n\n\n
SSL\/TLS certificates help browsers authenticate websites and establish encrypted connections. Their reliability depends partly on private keys being sufficiently strong and remaining protected.<\/p>\n\n\n\n
An intermediate certificate authority can issue certificates beneath a trusted root. If its private key can be recovered, an attacker may be able to create fraudulent certificates and impersonate websites under suitable attack conditions.<\/p>\n\n\n\n
Cloudflare described the eight compromised intermediate certificates as a serious internet security incident. Google also published protective measures for Chrome and Android users. This establishes the significance of the vulnerability without proving that every website or customer suffered an attack.<\/p>\n\n\n\n
eMudhra linked its decision to both the incident and the economics of the business. Management cited rising compliance demands, operational complexity and competition from providers offering certificates free of charge.<\/p>\n\n\n\n
The company plans to concentrate on other enterprise solutions and trust services. It has also committed to helping customers move to replacement certificates and maintaining certificate-status and revocation services during the transition.<\/p>\n\n\n\n
The investor question is whether this withdrawal simplifies the business at a manageable cost – or whether the incident creates difficulties beyond the business being closed.<\/p>\n\n\n\n
The disclosed revenue contribution does not establish the total financial impact.<\/strong> Revenue measures the size of a business line. It does not capture every possible consequence of a security incident. The following are monitoring points, rather than confirmed outcomes:<\/p>\n\n\n\n