eMudhra Limited Exits Global TLS Business After Incident

eMudhra Limited has said it will voluntarily exit the global Secure Sockets Layer/Transport Layer Security certificate business after a global TLS incident affected eight intermediates and one Root CA. The company said its India digital-signature and eSign operations were unaffected, with the financial effect estimated at about 1% of revenue.

What happened in eMudhra's global TLS certificate business?

eMudhra said select Global TLS Intermediate certificates and one Root CA were subject to distrust following a global TLS incident. The company confirmed that eight TLS intermediates were affected. It also stated that there had been no infrastructure compromise or data breach.

The development is material because TLS certificates support encrypted connections between websites and users. Browser trust is an important part of this business, and distrust of certificate authorities, roots or intermediates can affect the acceptance of certificates by browsers and related systems. eMudhra has said its roots had been included in browser trust lists since mid-2025.

The company has said that independent audits had been completed for two consecutive years. However, it has also acknowledged that the incident has created a larger public-trust test for its global certificate operations. The stated decision is to exit the global SSL/TLS certificate business voluntarily.

Why is eMudhra leaving the global TLS certificate business?

eMudhra is leaving the global TLS certificate business after the distrust action involving select intermediates and one Root CA. The company has not presented the decision as an expansion or a commercial restructuring; it follows the incident and the resulting need to address customer confidence in the affected global business.

Srinivasan said eMudhra would commission an independent review beyond the specific incident. The proposed auditor will examine the incident, assess what happened, and review the company's processes, procedures and records. The review will also examine the company's entire cryptographic estate and provide an assessment.

The company has committed to placing the report in the public domain. That commitment is relevant because the incident concerns trust infrastructure, where customers, browser ecosystems and other users depend on transparent controls and reliable operational processes. No timetable for publishing the report was provided in the available disclosures.

Which eMudhra businesses remain unaffected?

eMudhra said its India digital-signature certificate and eSign businesses are unaffected by the global TLS incident. The company described these signing services as operating on separate infrastructure and said it had spoken individually with key customers regarding their operations.

Its Indian digital-signature operations are conducted as a licensed Certifying Authority under the Controller of Certifying Authorities, India. eMudhra markets these Digital Signature Certificates for statutory and regulatory filings. The company has specifically differentiated these operations from the affected global TLS certificate business.

The distinction matters for customers that use eMudhra for Indian compliance-related signing and eSign workflows. Based on the company's statement, there is no reported impact on these services from the TLS incident. The company has not disclosed any service interruption or customer-data impact in its India signing operations.

What do eMudhra's financial disclosures show?

eMudhra has estimated that the global TLS incident will affect about 1% of its revenue. The available information does not provide an absolute revenue amount associated with this estimate, so the financial effect cannot be calculated further from the disclosed data.

Separately, eMudhra reported consolidated profit after tax of ₹32 crore for the first quarter, up 28% year on year. It said Cryptas lifted revenue by 29%. These reported quarterly figures provide context for the company’s operating performance but do not change its stated estimate for the TLS-related revenue impact.

The company’s financial results were accompanied by limited review reports from its independent auditor. Its standalone financial statements for the year ended March 31, 2026 were audited, according to the auditor’s report. On May 6, 2026, the board also reappointed CNGSN Associates LLP as internal auditor for financial year 2026-27.

How does the TLS incident affect investors and customers?

eMudhra's planned withdrawal narrows its exposure to the global TLS certificate segment, while its India DSC and eSign businesses remain separate and unaffected according to the company. For customers using those domestic signing services, the central company disclosure is that there was no infrastructure compromise, data breach or reported service impact.

For investors, the incident has led to a revision in credit ratings after a review triggered by the material event involving the global TLS certificate business. The available information does not state the revised rating level or the full rationale, but it establishes that the event has drawn attention from credit-rating agencies.

The broader issue is operational trust rather than only the estimated 1% revenue effect. Certificate businesses rely on confidence from users and trust-list operators. eMudhra’s proposed independent assessment and commitment to publish its findings are therefore significant disclosures, although the outcome of that review has not yet been made available.

Conclusion

eMudhra Limited has confirmed that the global TLS incident affected eight intermediates and one Root CA, while reporting no data breach or infrastructure compromise. Its decision to leave the global TLS certificate business limits the issue to that segment, and the company has estimated the associated revenue effect at about 1%.

The next disclosed step is the independent review of the incident, internal processes and eMudhra's wider cryptographic estate. Customers and investors will watch for the public report, the company’s handling of the voluntary TLS exit, and further details on the credit-rating review linked to the material event.