Every day, millions of people use online banking, sign digital documents and access government services without thinking about the technology that makes these activities possible.
When you open your bank’s website, you’ll usually see a little padlock next to the web address. It tells you that your connection is encrypted and that your browser has verified the website’s digital certificate.
But what if the system that tells your browser which websites to trust gets it wrong?
An Indian cyber security company has come under scrutiny after researchers discovered that eight of its digital certificates had private keys so weak that they could be cracked in less than a second.
The company is eMudhra, whose certificates are trusted by major browsers around the world. Google, Apple, Microsoft and Mozilla have blocked the affected certificates.
To understand the seriousness of this, think of a digital certificate as an identity card for a website. A certificate authority is like an organisation authorised to verify identities and issue these cards. Its private key is the secret credential used to sign certificates and establish that they can be trusted. India’s IT ministry has now constituted a special team to investigate the incident while assuring users that domestic digital signature and e-sign services remain unaffected.
What does eMudhra do?
eMudhra answers three important questions:
”Who are you, Is the signature genuine & verifiable and Is the website trustworthy?”
But how did this happen and why does a flaw in eight certificates matter to millions of internet users?
First, lets understand how does our browser know that a certificate is genuine? It checks the digital signature on it created using a secret number called a private key and that key must be virtually impossible to guess. In this case, researchers found that the private keys behind eight eMudhra certificates were dangerously weak. One of them was simply the number 4. The other keys included 66, 155, and 237. Instead of being generated with sufficient randomness, the keys were so small that researchers could recover them in less than a second.
According to eMudhra, the problem originated during a key-generation process in April 2025. eMudhra says a flaw in its certificate generation process in April created a second set of weak keys alongside the intended strong ones. Those weak keys ended up in the affected certificates.
Here’s where the risk becomes serious.
Someone who possesses these private keys could potentially create fake certificates for websites that they don’t own. That could include a bank, an email service, or another website. If a browser or application still trusted the compromised certificate, it could accept a fraudulent digital identity.
And if an attacker could intercept the connection, they might impersonate the real website or intercept and alter information being exchanged. The risk is not limited to websites either. Two of the affected certificates were meant for signing software. That raises concerns about fraudulent software signing too.
eMudhra says that there is no evidence so far of a cyber-attack or data breach linked to the incident. The response was swift. Google, Apple, Microsoft, and Mozilla blocked the affected certificates and eMudhra revoked all eight.
What’s next for eMudhra?
On October 22, eMudhra’s board decided to voluntarily exit its global SSL/TLS certificate business. The company said this segment contributes approximately 1% of its revenue and cited the growing complexity, compliance requirements and costs associated with operating a globally trusted certificate business.
So, exiting this business alone is unlikely to explain the scale of the market’s reaction. Yet, the company’s stock fell by around 40% over three trading sessions by October 23, 2026.
Now, why would investors react so sharply to a business that contributes such a small share of revenue?
The answer lies in the difference between losing revenue and losing trust.
When a cybersecurity company faces a security failure, investors don’t just assess the business directly affected. They also begin asking whether the same weaknesses could exist elsewhere, whether customers might reconsider their relationships with the company, and whether future growth could suffer. For eMudhra, this creates three concerns.
- First, Reputational damage. Even if its Indian digital signature and eSign services remain unaffected, customers may become more cautious about trusting the company with other security-critical systems.
- Second, Uncertainty about future growth. The company may need to spend more on security controls, audits and compliance, while also working to reassure customers and business partners. The financial impact of these efforts is not yet clear.
- Third, Investor confidence. Markets tend to price in uncertainty before its full financial consequences become visible. Investors may be concerned not only about the revenue lost from the SSL/TLS business, but also about the possibility of wider consequences for the company’s reputation and growth.
There is, however, another side to the story. eMudhra says its core enterprise solutions and other digital trust services remain unaffected, and the company plans to focus on these businesses after exiting global SSL/TLS certificate issuance. If it can demonstrate that its remaining operations are robust and retain customer confidence, the long-term impact could be more contained than the initial stock reaction suggests.
For now, the 40% fall reflects the market’s concern and uncertainty; it does not, by itself, establish how much the company’s future earnings will be affected.
The numbers to watch are whether its core businesses continue to grow, whether customers remain with the company, what the investigation reveals, and whether eMudhra can restore confidence in its security processes.
The bigger question for investors is no longer just how much revenue eMudhra is losing by exiting a 1% business. It is whether the incident changes the market’s confidence in the other 99%.
Let us know what do you think about this and what matters more for you, the actual financial impact, or the risk of losing trust?