eMudhra News: Certificate Breach, CERT-In Advisory and Is Your DSC Safe?

eMudhra is one of India's biggest digital signature providers, and this week it is everywhere in the news. Weak keys in eight certificates, a CERT-In advisory, browser blocks, a 20% stock crash and an exit from the global SSL business all happened within six days. Business owners are now asking one question: is my eMudhra DSC still safe? This guide answers that, along with everything else people are searching.

eMudhra News Today: Quick Details

Why Is eMudhra in the News?

Weak Keys

A researcher found that private keys of eight eMudhra intermediate certificates were so weak they could be rebuilt in under a second. One key was reportedly as simple as the number four.

Why Risky

Intermediate certificates issue website security certificates. With these keys, an attacker could create fake certificates and impersonate genuine websites, including bank or government portals, to intercept data.

Fast Blocking

Mozilla blocked the certificates within hours of the report. Google, Apple and Microsoft followed within days, so updated browsers now reject anything signed with the compromised keys.

No Misuse Found

eMudhra says the affected certificates issued no customer certificates and no data breach occurred. Public disclosures so far show no confirmed malicious use of the compromised keys.

eMudhra CERT-In Advisory: What It Says

The Warning

CERT-In warned that the compromised keys could be used to create fake websites, intercept communication and sign malicious software so it appears to come from a trusted publisher.

Update Systems

CERT-In asked organisations to update browsers, operating systems and applications. Outdated software may still trust the compromised certificates even after browser makers blocked them.

Refresh Trust Lists

Servers and devices should receive current trusted-certificate lists and revocation data. IT teams should identify any eMudhra-issued website certificates in use and replace them quickly.

Who Must Act

The advisory targets government departments, internet service providers, software vendors and website administrators. Individual DSC users filing GST or ROC returns do not need to act.

Is eMudhra DSC Safe After the Security Breach?

Short Answer

Yes. eMudhra, MeitY and CERT-In all say Indian Digital Signature Certificates and eSign services are unaffected. Your eMudhra DSC stays valid until its normal expiry date.

Separate System

The issue was in eMudhra's global website-certificate (SSL/TLS) business. The Indian DSC business runs on completely separate infrastructure regulated by India's Controller of Certifying Authorities.

Portals Working

eMudhra Class 3 DSCs continue to work on GST, MCA21, income tax, EPFO, DGFT, ICEGATE and e-procurement portals. No portal has announced any change for eMudhra DSC holders.

eSign Running

Aadhaar-based eSign by eMudhra is also working normally. Contracts, HR documents and onboarding forms signed through eSign remain legally valid under the IT Act.

eMudhra Share Price Fall: What Happened

Lower Circuit

eMudhra shares hit a 20% lower circuit at ₹431.55 on BSE on 21 October 2026, as investors reacted to the security incident and possible reputational damage.

Revenue Impact

The company says global SSL/TLS contributes only about 1% of its revenue. Its main businesses, DSC, eSign and enterprise digital-trust solutions, are not part of the exit.

For Investors

StartupFlora does not give stock advice. Investors should follow eMudhra's stock exchange filings and consult a SEBI-registered adviser before taking any buy, hold or sell decision.

eMudhra SSL Exit: What It Means

What Closes

eMudhra is leaving only the global SSL/TLS certificate business, which secures website padlocks. It is not shutting down, and its India operations continue as before.

Root Removal

Chrome will remove eMudhra's emSign ECC Root CA – G3 from its trusted list on 27 October 2026. Websites still using certificates from that chain may show security errors.

Website Owners

If your business website uses an eMudhra SSL certificate, replace it before 27 October. eMudhra says it will arrange replacement certificates through partner certificate authorities.

What MSMEs and Startups Should Do Now

Check Website

Open your website, click the padlock and view the certificate issuer. If it shows eMudhra or emSign, ask your hosting provider to install a new SSL certificate immediately.

Update Browsers

Update Chrome, Firefox, Edge, Safari and office computers' operating systems. This is the main step CERT-In recommends, and it protects staff from fake websites using forged certificates.

Check DSC Expiry

Open your DSC token utility and check the validity date. Renew at least 15 days before expiry so GST, TDS or ROC filings do not fail near deadlines.

Beware Fraud Calls

Ignore calls or WhatsApp messages asking you to "urgently replace" your eMudhra DSC for a fee. Fraudsters use trending news to collect money, OTPs and identity documents.

Verify Portal URLs

Always type GST, MCA and bank portal addresses directly. Do not log in through links from SMS or email, as the CERT-In warning specifically covers fake websites.

eMudhra DSC vs SSL Certificate: Which One Was Affected?

Documents Required for DSC Renewal

If your DSC is due for renewal, keep these ready.

PAN Card

PAN is mandatory for a Class 3 individual DSC. The name on PAN must match the application exactly to avoid rejection during certifying authority verification.

Aadhaar

Aadhaar eKYC allows fully paperless DSC issuance. Keep your Aadhaar-linked mobile number active to receive the OTP during the verification process.

Photograph

A recent passport-size photograph is required. Most providers also run live video verification, so keep your original ID and a well-lit space ready.

Organisation Proof

For an organisation DSC, keep the company PAN, GST or incorporation certificate, and an authorisation letter on the company letterhead signed by an authorised signatory.

How to Renew a DSC Safely

Pick Provider

Choose any CCA-licensed certifying authority, including eMudhra. Class 3 DSCs from all licensed providers work the same way on Indian government portals.

Choose Type

Select a Class 3 signing DSC for filings, or a signing plus encryption combo for e-tenders. Pick one, two or three-year validity based on your needs.

Complete KYC

Fill the application on the provider's official website and complete Aadhaar or PAN-based eKYC, followed by video verification. Avoid unknown agents offering "instant" DSCs.

Download Token

Download the approved DSC onto a FIPS-compliant USB token. Set a strong PIN and keep the token with a trusted person in your business.

Register Again

Register the renewed DSC on GST, MCA and income tax portals. Old registrations do not carry over automatically when you renew or replace a certificate.

Frequently Asked Questions on eMudhra News

1. Why is eMudhra in the news today? Weak private keys were found in eight eMudhra intermediate certificates. Browsers blocked them, CERT-In issued an advisory, shares fell 20% and eMudhra announced its exit from global SSL/TLS.

2. Is eMudhra DSC safe to use? Yes. eMudhra, MeitY and CERT-In confirm Indian DSC and eSign services are unaffected. Your DSC works normally for GST, MCA and income tax filings.

3. Was eMudhra hacked? eMudhra says its infrastructure was not compromised and no data was breached. The problem was weak key generation in eight certificates, not a hacking of its systems.

4. What did the CERT-In advisory on eMudhra say? CERT-In warned the keys could enable fake websites and malicious software. It asked organisations to update browsers, systems and trust lists, and to replace affected certificates.

5. Why did eMudhra share price fall? Shares hit a 20% lower circuit at ₹431.55 on BSE on 21 October 2026 after news of the certificate compromise and concerns over reputational damage.

6. Is eMudhra shutting down? No. eMudhra is exiting only the global SSL/TLS business, about 1% of revenue. DSC, eSign and enterprise businesses continue in India and abroad.

7. Do I need to replace my eMudhra DSC? No. This incident does not require DSC holders to replace certificates. Renew only when your DSC reaches its normal expiry date.

8. My website uses an eMudhra SSL certificate. What should I do? Replace it before 27 October 2026, when Chrome removes the emSign ECC Root CA – G3. Contact your hosting provider or eMudhra for a replacement.

9. Were any websites or users attacked? No confirmed misuse has been reported so far. eMudhra says the affected certificates issued no customer certificates, and browsers now block them.

10. Can I still buy a new eMudhra DSC? Yes. eMudhra continues issuing DSCs in India. You may also choose any other CCA-licensed certifying authority if you prefer.

Conclusion: Your DSC Is Safe, Your Website May Need Attention

The eMudhra news is serious for internet security, but it does not affect the digital signatures Indian businesses use for GST, MCA, income tax and tenders. Your eMudhra DSC remains valid. Three things do need your attention this week: update your browsers, check if your website runs an eMudhra SSL certificate before 27 October, and ignore any calls pushing "urgent DSC replacement".

Need help with DSC renewal, GST compliance or ROC filings? Talk to the StartupFlora team or explore our business services for end-to-end compliance support.