Digital security firm eMudhra is exiting its global business of issuing security certificates for websites, including India’s income tax portal, after Google, Apple and Microsoft stopped trusting its SSL/TLS certificates over vulnerabilities that raised cybersecurity concerns.
Udhayan Adhye, founder of MoneyIQ, has shared four steps users should take to protect their devices, personal information and financial accounts.
Adhye advised users to update their internet browsers, phones and laptops, install the latest versions of banking and trading applications, and check for security updates for routers and smart devices.
“Chrome and Firefox users have been protected since October 17, but fixes for other software can take weeks,” he said.
The company’s decision to exit the business followed the discovery of vulnerabilities in some of its certificates. SSL/TLS certificates help verify website identities and encrypt information exchanged between users and websites, protecting online communications from interception.
eMudhra’s customers reportedly include IT companies such as Infosys and TCS, as well as government agencies. Its certificates have also been used to secure websites such as India’s income tax portal.
What caused the eMudhra certificate breach?
The vulnerabilities came to light after an independent cybersecurity researcher found weaknesses in some of eMudhra’s certificates that could make them susceptible to attacks.
The issue was traced to eight cryptographic keys generated by the company in April 2025. According to Reuters citing eMudhra co-founder Kaushik Srinivasan, a software error had shortened the keys, making them significantly weaker and easier to break.
Cryptographic keys are strings of characters used by encryption systems to secure information exchanged online. Weak or compromised keys could potentially allow attackers to impersonate legitimate websites or interfere with secure communications.
The company said the vulnerability had remained undetected for 18 months despite two rounds of audits. It maintained that its infrastructure had not been compromised and that no data had been breached.
What has eMudhra said about the incident?
eMudhra said it had withdrawn the eight affected certificates, while maintaining that its infrastructure had not been compromised and no data had been breached. The company also said the affected global SSL/TLS certificate business accounted for around 1% of its revenue.
The incident prompted browser makers and cybersecurity authorities to take action. Google and Mozilla blocked the affected certificates in Chrome and Firefox, while other technology companies also withdrew trust in them.
India’s Computer Emergency Response Team (CERT-In) said on Wednesday that some of eMudhra’s intermediate certificates had been compromised. The development has raised concerns about devices and software that may not receive security updates as quickly as mainstream browsers.
The company has maintained that its Indian digital signature certificate and eSign services remain unaffected, as the issue is limited to its global website security certificate business.
eMudhra shares fall after certificate controversy
The cybersecurity concerns have also affected investor sentiment. eMudhra shares fell around 40% over the two trading days after the vulnerability was disclosed, according to Reuters.
The company said social media attention had brought disproportionate scrutiny to a business that contributes only a small portion of its overall revenue.