eMudhra: Global TLS CAs Distrusted; India Business Unaffected

eMudhra Limited has issued a statement regarding the distrust of eight of its intermediate Certificate Authorities (CAs) used in its global TLS business. These CAs, created under eMudhra's ECC root, were found to have weak keys due to a flaw in the Key Generation Ceremony (KGC). An independent researcher discovered this flaw, which could be reverse-engineered. eMudhra confirms no infrastructure compromise or data breach occurred, and its Indian Digital Signature Certificate (DSC) and eSign businesses remain unaffected as they operate on separate infrastructure. The affected global TLS business represents about 1% of the company's revenue, but reputational risks exist. eMudhra is providing replacement certificates to affected customers and investigating the root cause.