Ratings retained at [ICRA]A (Stable)/[ICRA]A1; agency notes Board’s decision to exit the global TLS certificate business BENGALURU, INDIA, October 23, 2026 - Credit rating agency ICRA has kept eMudhra’s ratings unchanged after a security incident in its business of issuing website security certificates, a business the company has now decided to exit. ICRA has retained the ratings at [ICRA]A (Stable)/[ICRA]A1 on Rs 35 crore of eMudhra Limited’s unallocated limits, in an update on a material event issued today. The agency has recorded the incident in the company’s global Transport Layer Security (TLS) certificate business and the Board’s decision to withdraw from it. ICRA noted that eMudhra informed the stock exchanges on October 21 of a flaw at a key generation ceremony on April 30, 2025. The flaw produced a weaker second set of cryptographic keys for eight intermediate Certificate Authorities, and that set was published to browser root stores. An independent researcher reported the matter on October 17. Google Chrome and Mozilla Firefox blocked the affected intermediates within hours, followed by Apple and Microsoft, and eMudhra revoked the certificates. The agency also noted that on October 22 the Board decided to voluntarily withdraw from the global SSL/TLS certificate business and focus on core enterprise solutions and other trust services. The Indian Computer Emergency Response Team has issued an advisory, and the Ministry of Electronics and Information Technology has indicated that the matter has very limited impact on the Indian customers and has not affected the Indian certifying authority business including eSignature. ICRA’s update records management’s position on the impact. The company has stated that no data was breached and its security controls remained intact. None of the affected intermediates issued end entity certificates, and these intermediaries were revoked within 14 hours of detection. The global TLS business contributes only about 1 per cent of consolidated revenue. The Digital Signature Certificate and eSign businesses are unaffected, as are the Global Services and European businesses which run on different brand names, thus even the reputation risk is contained only to certain businesses. Kaushik Srinivasan, Co-Founder, eMudhra, said, “We found a flaw in our own process and we have owned it. Stepping out of global TLS lets us put our full effort into the core solutions and the services our customers depend on every day.” About eMudhra With over 17 years of expertise, eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI), enterprises, and governments across more than 35 countries worldwide. Its product suite spans CertiNext (PKI and certificate lifecycle management), SecurePass (identity and access management, multi-factor authentication and converged identity), and PrivaTrust (data discovery and consent management for global data-privacy compliance and DSARs), delivering high-assurance digital trust at population scale.