Fintech News · 22 October 2026 · 3 min read
In short: eMudhra, an Indian company that issues digital security certificates, made a mistake in 2025 that left eight of its certificates protected by keys that were far too easy to guess. A researcher spotted it on 17 October. Chrome, Firefox, Apple and Microsoft blocked the certificates within days. No misuse has been found, and eMudhra says its Indian digital signature and Aadhaar eSign services are not affected. Its shares still fell about 36% in two days.
First, what does eMudhra do?
When you open a website and see the padlock in your browser, it means the site has shown a digital certificate, a bit like an ID card, proving it is genuine. Companies called certificate authorities issue these ID cards, and browsers trust them to do it honestly.
eMudhra is one of these authorities. It is best known in India for digital signature certificates (used to file taxes, GST returns and company documents online) and eSign (signing documents with Aadhaar). It also started issuing website certificates worldwide in 2025.
What went wrong?
Every certificate authority has secret “master keys” used to stamp the ID cards. These keys must be impossible to guess, like a password billions of digits long.
In April 2025, during the ceremony where eMudhra created new keys, a faulty script made a second set of very weak keys, and staff picked the wrong set. The result: eight master keys could be worked out by anyone in under a second. In theory, someone could have used them to make a fake “padlock” for any website, such as a bank’s.
Timeline
| Date | What happened |
|---|---|
| 30 April 2025 | eMudhra creates the keys; the weak ones go into use |
| 17 October 2026 | A researcher finds the flaw and alerts Google, Mozilla, Apple, Microsoft and eMudhra. Chrome and Firefox block the certificates the same day |
| 18 October | eMudhra cancels (revokes) the eight certificates |
| 19–20 October | Apple, Android and Microsoft block them; Firefox stops trusting one eMudhra root certificate |
| 21 October | India’s IT ministry forms a team to investigate; CERT-In issues an advisory. Shares fall 20% |
| 22 October | Shares fall another 20% to a 52-week low of about ₹345 |
Does this affect you?
- If you use a phone or computer: keep your browser and phone updated. The fixes have already been pushed to Chrome, Firefox, Safari, Edge and Android, mostly automatically.
- If you use a digital signature or Aadhaar eSign: eMudhra and the IT ministry say these run on separate systems and are not affected.
- If you run a website with an eMudhra certificate: switch to a certificate from another provider soon. Chrome plans to stop trusting one of eMudhra’s root certificates around 27 October.
- If you hold eMudhra shares: the company says the affected global website business is only about 1% of revenue, but it admits the damage to its reputation “cannot be quantified”.
What eMudhra says
The company says its systems were not hacked and no data was stolen. It says only one of the eight certificates was actually in use and none had issued certificates to customers. It has revoked them, is giving affected customers replacements, and will re-check all its past key ceremonies.
Why it matters
The internet’s padlock system only works if everyone trusts the companies that issue certificates. Even without any known misuse, a mistake like this can cost a certificate authority that trust, which is why browsers acted fast and investors reacted sharply.
Sources
- The Hacker News: Eight eMudhra CA keys compromised (20 October 2026)
- Help Net Security: eMudhra signing keys exposed (21 October 2026)
- Business Standard: eMudhra hits second straight 20% lower circuit (22 October 2026)
- 5paisa: Why eMudhra shares fell in two sessions
This is a news summary for education, not investment advice. Details are as reported up to 22 October 2026 and may change as investigations continue.