Jump to content

eMudhra

From Wikipedia, the free encyclopedia

eMudhra Limited
Formerly
  • 3i Infotech Consumer Services Limited (2008–2010)
  • eMudhra Consumer Services Limited (2010–2014)
TypePublic
NSE: EMUDHRA
IndustryCertificate authority
FoundedJune 16, 2008; 18 years ago (2008-06-16)
HeadquartersBengaluru, Karnataka, India
Key people
  • Venkatraman Srinivasan (founder)[1]
Revenue₹701.6 crore (FY2026)[2]
Parent3i Infotech Edit this on Wikidata
Websiteemudhra.com
Logo of emSign, the brand name used for certificates. It was a certificate authority from 2018 until it left the market in 2026.

eMudhra Limited is an Indian public key infrastructure company founded in 2008 and based in Bengaluru. It is licensed by the Controller of Certifying Authorities to issue digital signature certificates in India, where it is one of the leading issuers, and it went public in 2022. It became the only Indian root certificate authority trusted by the major web browsers. As of 2026, the company has issued more than 60 million digital certificates.[3]

In October 2026, the private keys of eight of its intermediate certificates were found to be extremely weak, leading browser vendors to block the certificates. Days later, eMudhra announced that it would leave the TLS certificate business.

History

[edit]

eMudhra was incorporated in Mumbai on June 16, 2008, as 3i Infotech Consumer Services Limited, a wholly owned subsidiary of 3i Infotech.[4] It received a certifying authority licence from the Controller of Certifying Authorities the same year.[4] After it was acquired by Indus Innovest Technologies in 2010, it was renamed eMudhra Consumer Services Limited.[4][5] It moved its registered office from Navi Mumbai to Bengaluru in 2011 and took the name eMudhra Limited in 2014.[4] Venkatraman Srinivasan, a former managing director and chief executive of ICICI Infotech, has been a director since the company was incorporated and is its executive chairman.[4]

According to its prospectus, eMudhra became India's first eSign service provider in 2015 and launched its emSigner paperless-office software the same year. It completed a WebTrust audit and launched its emSign certificate authority in 2018.[4] In December 2018, Mozilla approved the inclusion of four emSign root certificates, among them emSign ECC Root CA – G3, in its trust store.[6] Browsers had been reluctant to trust Indian root certificate authorities since the National Informatics Centre's certificate authority issued unauthorised certificates in July 2014. As of 2026, eMudhra was the only Indian root certificate authority trusted globally.[7]

According to a Frost & Sullivan report commissioned for its prospectus, eMudhra was the largest licensed certifying authority in India in the 2021 financial year, with 37.9% of the digital signature certificate market.[4][5] Its ₹413 crore initial public offering in May 2022 was subscribed 2.7 times, and its shares were listed on the National Stock Exchange of India and the Bombay Stock Exchange on June 1, 2022.[8][9] In 2026, the credit rating agency ICRA put its share of the Indian market at around 30% by value, based on management estimates.[2]

The company's enterprise solutions segment, which sells software for secure access, public key infrastructure, paperless workflows and certificate lifecycle management, grew from about 54% of its revenue in the 2022 financial year to about 80% in 2026, when international markets provided 64% of revenue.[2] In 2023, eMudhra agreed to buy a 51% stake in Ikon Tech Services, a cybersecurity and digital transformation company in Houston, to expand in the United States.[10][11] It later bought a 51% stake in Cryptas International, and Europe's share of its revenue rose from about 1% in the 2025 financial year to about 12% in 2026, mainly because of that acquisition.[2]

In 2026, eMudhra began a partnership with LankaSign.[12]

2026 intermediate certificate compromise

[edit]

On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised.[13][14]

The compromised private keys were 4, 56, 66, 115, 155, 156, 230, and 237.[14] A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits, making them significantly less secure.[14] Security researcher Scott Helme said he had recovered several of the keys from the certificates' public keys in less than a second.[3] Six of the certificates were for TLS website security and two were for code signing.[15] Because the keys could be recovered from the public certificates, anyone could have used them to issue certificates for any website that browsers would trust.[14][3] eMudhra said the keys were created in a key generation ceremony on April 30, 2025, when a flaw in a "key wrap/unwrap" step produced a second, weak set of keys alongside the intended ones, and that staff used the weak keys by mistake.[16] As of 21 October 2026, it was still working to establish the root cause.[15][7]

Google Chrome and Firefox blocked the certificates within hours of the report.[16] Apple followed on October 19 and Microsoft on October 20.[13] eMudhra revoked the eight certificates.[3] Google said none of the six TLS intermediates had issued certificates recorded in Certificate Transparency logs, and eMudhra said only one of the eight had been put into use and none had issued certificates to customers.[15] On October 20, Mozilla removed the root certificate that had issued them, emSign ECC Root CA – G3, from NSS, and on October 21, Google stated that Chrome would also remove the root certificate from its Chrome Root Store by the morning of October 27.[17][13] eMudhra said about 30,000 customer certificates under the removed root would have to be moved to its other root.[15] The cleanup is expected to take a long time, because many Linux distributions, embedded devices, and applications ship their own copies of root certificates.[14][18]

Many Indian government websites used eMudhra for certificates, including Aadhaar issuer UIDAI and its income tax portal.[7] Revocation of eMudhra certificates made several websites inaccessible, including government websites such as FSSAI and Higher education department of Kerala.[19]

On October 21, eMudhra's shares fell 20%, hitting the maximum allowed drop in a day on the Bombay Stock Exchange and the National Stock Exchange of India.[15][20] In a filing to the stock exchanges, the company said the affected business accounted for about 1% of its revenue and that its Indian digital signature certificate and eSign services ran on separate systems.[15] The same day, the Indian Computer Emergency Response Team issued an advisory on the compromise, and the Ministry of Electronics and Information Technology said it had set up a special team to investigate and that digital signature certificates and eSign services regulated by the Controller of Certifying Authorities were unaffected.[15][7]

On October 22, eMudhra announced it would withdraw from the global SSL/TLS certificate business, which it said provided about 1% of its revenue, and said the scrutiny the incident had drawn on social media was out of proportion to the business's place in the company.[21] It said its G1 RSA root certificates would continue to serve customers during the transition and that it would deliver a full root-cause report to the browser root programs.[22] Its shares had fallen 40% in the two days after the vulnerability was disclosed.[21]

See also

[edit]

References

[edit]
  1. ↑ "Leadership Team at eMudhra - Meet Our Executives - India". emudhra.com. Archived from the original on May 21, 2026.
  2. 1 2 3 4 "Emudhra Limited: Ratings reaffirmed". ICRA. June 29, 2026. Retrieved October 22, 2026.
  3. 1 2 3 4 Sharwood, Simon (October 20, 2026). "Indian certification authority eMudhra's private keys compromised – one of them was the number '4'". The Register. Retrieved October 21, 2026.
  4. 1 2 3 4 5 6 7 "Red Herring Prospectus: eMudhra Limited" (PDF). National Stock Exchange of India. eMudhra Limited. May 10, 2022. pp. 178, 225–227, 236. Retrieved October 22, 2026.
  5. 1 2 Kashyap, Hemant (May 18, 2022). "eMudhra IPO: Digital Signature Provider Readies For INR 413 Cr IPO, Sets Price Band". Inc42. Retrieved October 22, 2026.
  6. ↑ "Bug 1442337 – Add New emSign Root Certificates". Bugzilla@Mozilla. December 19, 2018. Retrieved October 22, 2026.
  7. 1 2 3 4 "Eight web security keys of eMudhra firm used by Govt. and PSUs leaked". The Hindu. October 21, 2026. ISSN 0971-751X. Retrieved October 22, 2026.
  8. ↑ "eMudhra makes decent debut, stock lists at 6% premium to issue price". Business Standard. June 1, 2022. Retrieved October 22, 2026.
  9. ↑ "eMudhra ends flat on debut after 9% spike over IPO price in intraday trade". Business Standard. June 2, 2022. Retrieved October 22, 2026.
  10. ↑ "Emudhra Limited: Ratings upgraded; outlook revised to Stable from Positive". ICRA. June 26, 2023. Retrieved October 22, 2026.
  11. ↑ "eMudhra Acquires Majority Stake in Ikon Tech Services". ChannelE2E. May 22, 2023. Retrieved October 22, 2026.
  12. ↑ "eMudhra and LankaSign announce strategic partnership to make digital signing seamless". The Island. January 2, 2026.
  13. 1 2 3 Firefox Security Team (October 20, 2026). "Protecting Firefox users following the compromise of eMudhra intermediate certificates". Mozilla Security Blog.
  14. 1 2 3 4 5 Goodin, Dan (October 20, 2026). "The Internet goes on high alert after discovery of 8 compromised TLS certs". Ars Technica. Archived from the original on October 20, 2026. Retrieved October 20, 2026.
  15. 1 2 3 4 5 6 7 Tulsian, Vrinda (October 21, 2026). "What's the eMudhra security scare that has rattled the internet? All you need to know". ThePrint. Retrieved October 22, 2026.
  16. 1 2 "eMudhra: Private key compromise of Intermediate Certificates". Bugzilla. October 18, 2026.
  17. ↑ "Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates". Google. October 20, 2026. Retrieved October 21, 2026.
  18. ↑ 認証局eMudhraの中間証明書、秘密鍵が「数ミリ秒」で復元可能な脆弱性 大手各社が緊急遮断. ITmedia NEWS (in Japanese). October 21, 2026. Retrieved October 21, 2026.
  19. ↑ pranay (October 21, 2026). "SFLC.in's Statement on eMudhra Private Key vulnerability". Retrieved October 22, 2026.
  20. ↑ Jain, Anjali (October 21, 2026). "eMudhra's Security Key Flaw: What Went Wrong And Why Google, Mozilla Stepped In". Inc42. Retrieved October 22, 2026.
  21. 1 2 "Indian firm eMudhra exits global digital certificates business after vulnerability disclosure". Reuters. October 22, 2026. Retrieved October 22, 2026.
  22. ↑ "Press Release: eMudhra to Exit global SSL/TLS Certificate Business" (PDF). BSE. eMudhra Limited. October 22, 2026. Retrieved October 22, 2026.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=EMudhra&oldid=1381696971"