eMudhra Shares Fall 43% in Five Days, Down 53% From September High

eMudhra’s Certificate Business Exit Puts Trust and Customer Retention in Focus

A security incident has shifted attention from the share-price slide to the company’s response, regulatory review and ability to protect customer confidence.

A steep fall reflects uncertainty, not just one day’s trading

eMudhra shares dropped as much as 10% to ₹318 on the BSE in Monday’s intraday trade, setting a fresh 52-week low. The stock had fallen 43% over five trading sessions and was down 53% from its September 16 high of ₹677.50. At 11:04 AM, it was trading 9% lower at ₹322.75, while the BSE Sensex was up 0.09%.

Trading activity also picked up: 2.08 million shares changed hands across the NSE and BSE, around 1.5 times the average volume at the counter. The scale of the decline suggests investors are reassessing the risks around the incident and its possible effects on the business. The share-price move alone, however, does not establish the eventual financial impact.

What happened in the TLS certificate business

In its October 21 exchange filing, eMudhra said the incident involved eight intermediate Certificate Authorities created during a key generation ceremony on April 30, 2025. The company attributed the issue to a flaw that produced a weaker second set of cryptographic keys alongside the intended keys; those weaker keys were published to browser root stores.

An independent researcher reported the matter to major browser root programmes on October 17, 2026. Google Chrome and Mozilla Firefox blocked the affected intermediates within hours, followed by Apple and Microsoft, and eMudhra revoked the affected certificates. CERT-In issued an advisory, while Google said it would remove the emSign ECC Root CA – G3 from the Chrome Root Store from October 27, 2026. The company has said no misuse has been reported, but ICRA noted that it is not known whether the weak keys were exploited before disclosure.

Withdrawal may contain exposure, but migration matters

On October 22, eMudhra said its board had decided to voluntarily exit the global SSL/TLS certificate business and focus on enterprise solutions and other trust services. That decision draws a line under the affected business, but it also makes execution important: customers using the affected certificates need to move to other providers, in coordination with browser root programmes.

ICRA said the company had begun steps to migrate affected customers, while warning that delays could deepen reputational damage. It retained ratings of [ICRA]A (Stable)/[ICRA]A1 on ₹35 crore of unallocated credit limits, but flagged regulatory uncertainty, customer-retention risks and potential reputational harm. The rating agency said it would monitor the regulatory review, business momentum and order inflows in subsequent quarters.

The wider trust business faces the key test

The central investor question is whether the incident remains confined to global certificates or affects confidence in eMudhra’s broader trust and enterprise services. ICRA noted that overseas markets account for 64% of revenue and said the effect on customer acquisition and retention, particularly among BFSI and government clients, remains uncertain. Management indicated that 35%–40% of the global business would not be affected by reputational spillover, but the extent of any broader impact is yet to be seen.

Officials indicated that the impact on Indian websites and applications was minimal and short-lived, and that DSC and eSign services regulated by the Controller of Certifying Authorities were unaffected. Even so, the MeitY investigation could bring further findings or changes to compliance requirements. Any evidence of misuse or third-party claims could also add contingent-liability risks, ICRA said.

Key Highlights

• eMudhra fell 43% in five trading sessions and 53% from its September 16 high.
• The security incident involved eight intermediate CAs created in a 2025 key generation ceremony.
• The company has decided to exit its global SSL/TLS certificate business.
• ICRA retained its ratings but flagged reputational, regulatory and customer-retention risks.
• Migration execution and the MeitY review remain important developments to monitor.

Investor Note: The sharp decline highlights the uncertainty surrounding the incident, but it does not by itself quantify lasting damage to eMudhra’s business. Investors may wish to track the investigation, customer migration, order inflows and evidence of any impact beyond the certificate business before drawing conclusions about the company’s recovery prospects.