eMudhra expects 5-6% H2 FY27 revenue decline after incident

eMudhra expects the certificate-security incident to reduce estimated H2 FY27, or the second half of fiscal year 2027, revenue by approximately 5-6%, after revoking eight intermediate certificate authority certificates and exiting publicly trusted SSL/TLS sales. The discontinued sales line represented about 1% of revenue, while customer exposure was limited to one US ecosystem.

What happened in eMudhra's certificate-security incident?

eMudhra said an independent researcher reported weak keys in eight intermediate certificate authority, or CA, certificates on 17 October 2026. The certificates were within one publicly trusted elliptic-curve cryptography, or ECC, hierarchy created during an April 2025 key-generation ceremony.

The company revoked all eight intermediate CAs on 18 October 2026. eMudhra said its root keys were not affected, although browser root programmes distrusted the related ECC root as a precaution. The disclosed issue therefore concerned eight intermediates in one ECC hierarchy, rather than the root keys themselves.

None of the eight intermediate CAs had been used to issue end-entity certificates, according to eMudhra. The customer impact was limited to Transport Layer Security, or TLS, certificates that could potentially be affected in future because they chained to the distrusted root, within one customer ecosystem in the US.

The presentation describes the update as a summary of information publicly disclosed in October 2026. It does not state the number of TLS customers moved to replacement certificates, the cost of those replacements, or the date on which the external review will be completed.

How did eMudhra respond to the certificate incident?

eMudhra moved potentially affected TLS customers to replacement certificates from alternate publicly trusted providers at no cost. This action applied to certificates that could be affected in future through the distrusted root, while the company said none of the eight intermediates had issued end-entity certificates.

On 30 October 2026, eMudhra appointed KPMG as an independent external reviewer. KPMG is reviewing the procedures used for the April 2025 key-generation ceremony associated with the ECC hierarchy containing the eight weak-key intermediate certificates.

The company also voluntarily discontinued publicly trusted Secure Sockets Layer/Transport Layer Security, or SSL/TLS, certificate sales, citing low return on investment from this line. The business review repeats that publicly trusted SSL/TLS issuance is being discontinued going forward following the October 2026 announcement.

Digital signature certificates, eSign, eMCA, CertiNext, SecurePass, emSigner and PrivaTrust were not affected, according to eMudhra. The company separately lists five proprietary Enterprise Solutions platforms: emCA, CertiNext, SecurePass, emSigner and PrivaTrust.

How much revenue impact does eMudhra expect?

eMudhra currently estimates that the incident will cause an approximately 5-6% decline in estimated H2 FY27 revenue. This is a company estimate disclosed in the October 2026 incident update, not a reported H2 FY27 result or a full-year FY27 revenue forecast.

Publicly trusted SSL/TLS represented approximately 1% of revenue before eMudhra discontinued the sales line. The 5-6% estimated H2 FY27 revenue effect is larger than that stated product-line share, but the presentation does not allocate the forecast reduction among discontinued sales, customer disruption, replacement activity or other consequences.

The presentation does not provide a rupee value for the expected H2 FY27 reduction. It also does not state an estimated financial cost for the no-cost replacement certificates or the KPMG review announced on 30 October 2026.

Q2 FY27 operating figures provide a pre-estimate financial reference, but do not measure the incident's impact. Earnings before interest, tax, depreciation and amortisation, or EBITDA, rose to Rs 5.13 crore from Rs 4.22 crore in Q2 FY26, while profit after tax, or PAT, rose to Rs 3.34 crore from Rs 2.64 crore.

Which eMudhra business lines are affected?

eMudhra says the incident did not affect its digital signature certificates, eSign, eMCA, CertiNext, SecurePass, emSigner or PrivaTrust offerings. The stated customer impact was restricted to TLS certificates chaining to the distrusted root in one US customer ecosystem, rather than eMudhra's full product portfolio.

Trust Services accounted for 16% of revenue and declined 6% year on year in the business review. This segment includes eMudhra's role as a licensed certifying authority in India issuing digital signature certificates and eSign, while the presentation specifically identifies publicly trusted SSL/TLS issuance as the activity being discontinued.

Enterprise Solutions represented 66% of revenue and grew 36% year on year, compared with Services at 18% of revenue and 0% year-on-year growth. eMudhra describes Services as consulting and product-integration work that supports cross-selling into its platforms.

The presentation's latest listed revenue observations show Enterprise Solutions & Services at Rs 33.56 crore and Trust Services at Rs 6.21 crore, compared with Rs 13.71 crore and Rs 3.58 crore in the first listed observation. The same observations show India revenue at Rs 13.59 crore and international revenue at Rs 26.18 crore, versus Rs 6.25 crore and Rs 11.04 crore respectively in the first observation.

What should readers watch next at eMudhra?

eMudhra's next disclosed incident-related item is the KPMG review of the April 2025 key-generation ceremony procedures. The review was announced on 30 October 2026 and remains under way, with no completion date, findings, remediation timetable or subsequent browser-programme decision disclosed in the presentation.

The presentation also identifies post-quantum deadlines relevant to eMudhra's continuing platforms. The US National Security Agency's Commercial National Security Algorithm Suite 2.0 calls for quantum-safe purchasing from January 2027, while India's Department of Science and Technology sets migration markers of 2029 for critical infrastructure and 2030 for high-priority enterprise systems.

For publicly trusted TLS, the CA/Browser Forum marker is a 47-day certificate-validity period by March 2029. Since eMudhra has said it is discontinuing publicly trusted SSL/TLS issuance, that deadline is industry context for a category it is leaving, not a stated sales plan.

Conclusion

eMudhra has put a numerical estimate on the business effect of the October 2026 certificate-security incident: an approximately 5-6% decline in estimated H2 FY27 revenue. Its disclosed response combines the 18 October revocation of eight intermediate CAs, no-cost replacement certificates for potentially affected TLS customers, and withdrawal from publicly trusted SSL/TLS sales that represented about 1% of revenue.

The next stated milestone is KPMG's review of the April 2025 key-generation procedures, for which eMudhra has not disclosed a completion date or findings. Readers can also watch for any update to the H2 FY27 estimate and for performance in Enterprise Solutions, which represented 66% of revenue and grew 36% year on year as post-quantum purchasing begins from January 2027.