eMudhra has taken a major decision after a cybersecurity controversy wiped out nearly 40% of its share value across two trading sessions.

The company has announced its withdrawal from the global SSL/TLS certificate business. But there is an unexpected detail: the business being discontinued contributes only about 1% of the company’s revenue.

On October 22, 2026, eMudhra confirmed that its Board of Directors had decided to voluntarily exit the global SSL/TLS certificate segment following the discovery of serious cryptographic weaknesses.

The decision comes after major technology companies, including Google, Mozilla, Apple and Microsoft, moved to distrust affected digital certificates associated with eMudhra.

For shareholders, the announcement changes the central question. The issue is no longer simply whether the company can repair the affected certificates, but whether it can protect confidence in its much larger digital trust business.

The controversy began when an independent security researcher identified weaknesses in private keys associated with eight intermediate Certificate Authorities.

The affected keys were generated during a process conducted on April 30, 2025. Subsequent scrutiny identified weaknesses that could undermine the security assurances provided by those certificates.

Digital certificates help browsers verify website identities and establish secure connections. Weak certificate-authority keys can create risks because attackers may potentially exploit them to impersonate trusted websites.

The discovery prompted significant concern among browser providers and the wider cybersecurity community. On October 21, eMudhra shares fell 20% to approximately ₹432, reaching the session’s lower circuit.

Selling continued on October 22, with the stock suffering another steep decline. Reuters reported that the shares had fallen approximately 40% over the two sessions following disclosure of the vulnerabilities.

The scale of the market reaction is particularly striking when compared with the financial size of the affected business. According to eMudhra, its global SSL/TLS certificate operations account for approximately 1% of its global revenue.

That means the immediate revenue exposure from discontinuing this particular segment is relatively limited compared with the company’s overall business.

However, investors are also evaluating potential reputational consequences, customer confidence and the strength of the company’s security controls. In its October 22 announcement, eMudhra said the affected Certificate Authorities were revoked within 14 hours of discovering the problem.

The company also stated that no end-entity certificates had been issued from the affected Certificate Authorities. This is an important clarification because it indicates that the affected certificate authorities had not been used to issue individual website certificates.

eMudhra further maintained that its infrastructure had not been compromised and that no customer data breach had occurred. The company said its physical and logical security controls remained intact.

These statements distinguish the incident from a conventional cyberattack involving the theft of customer databases or a breach of core operating systems. Nevertheless, the weakness in certificate generation was sufficiently serious to prompt action from major browser trust programmes.

The company now intends to withdraw from the global SSL/TLS business rather than continue operating the segment under increasingly demanding technical and regulatory requirements.

Chairman V. Srinivasan explained that growing data sovereignty requirements, compliance obligations and operational costs had made the business more complex. He also highlighted competitive pressure from large organisations offering SSL/TLS certificates free of charge.

According to management, these factors had reduced the commercial attractiveness and return on investment of the business even before the latest controversy.

The Board concluded that exiting the segment would allow eMudhra to concentrate resources on its larger enterprise solutions and digital trust operations.

The company has clarified that its digital signature certificates, eSign services, enterprise public key infrastructure solutions, electronic signature platforms and identity authentication products remain unaffected.

Its Indian digital signature and eSign businesses are also continuing normal operations. This distinction matters because the global SSL/TLS certificate segment represents only one part of eMudhra’s wider product portfolio.

The withdrawal will not necessarily happen overnight. eMudhra plans to coordinate with browser programmes and customers to complete the transition.

The company said its G1 RSA roots would continue supporting customers during the transition and that affected customers would be offered replacement certificates through partners without additional cost.

Certificate revocation and status services will also remain available until the relevant certificates expire or are replaced. For investors, the financial questions now concern transition expenses, any exceptional charges and whether the controversy affects customer relationships outside the discontinued business.

A 1% revenue contribution does not mean the total financial impact is guaranteed to remain at 1%. Equally, the sharp stock-price decline does not prove that the company’s broader earnings capacity has suffered an equivalent reduction.

Management has not yet provided a quantified estimate of the overall earnings impact or a revised financial forecast resulting from the incident.

The next major event is eMudhra’s scheduled November 4, 2026 Board meeting to consider its Q2 FY27 financial results, followed by its planned November 5 earnings call.

Investors will be watching for management’s explanation of the incident, the costs of exiting the global SSL/TLS segment, the status of customer transitions and any changes to future business guidance.

The immediate revenue exposure may be small, but the controversy has raised a much larger question about confidence in a company whose core business is built around digital trust.

eMudhra’s ability to demonstrate strong controls, transparent remediation and stable enterprise demand will determine how the market assesses this episode over time.