eMudhra appoints KPMG as independent external reviewer after security incident: Here's what we know
eMudhra Limited on Friday announced that it has appointed KPMG to conduct an independent external review following an incident that led to the distrust of select global TLS intermediate certificate authorities earlier this month.
In an exchange filing, the company wrote, "Pursuant to Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, and in continuation of our earlier disclosure relating to the press release dated October 21, 2026 regarding the reported incident, wherein we had stated our commitment to appoint an independent external reviewer, we wish to inform you that the Company has appointed KPMG to undertake an independent review of the matter."
The appointment fulfils the commitment the company made in a press release on October 21, when it said an independent entity would be appointed to examine the matter. KPMG is one of the world’s largest professional services networks.
Following the incident, Kaushik Srinivasan, co-founder of eMudhra, said, "We said on October 21 that someone from outside the company would look at what happened, and we have now appointed KPMG to do that. Our customers and shareholders should be able to rely on the findings, and we will act on whatever the review tells us."
eMudhra said the independent review is intended to clarify the incident, identify any concerns that need to be addressed, and reinforce its governance and compliance processes.
According to eMudhra, a security researcher alerted the company and browser trust programmes on October 17 that private keys linked to eight of its intermediate certificate authorities could be recovered. The company said a procedural flaw had generated weak published keys, prompting Chrome and Firefox to block the affected TLS certificates. eMudhra revoked all eight intermediates the next day, while browser root programmes distrusted the related ECC root as a precaution.
The company said seven intermediates were never used, while the eighth had not issued any certificates. It added that the impact was limited to one customer ecosystem in the United States using certificates linked to the distrusted root.
In its October 21 statement, eMudhra said its infrastructure and customer data had not been compromised. Its digital-signature, eSign and enterprise products, including emSigner, CertiNext, emCA, Privatrust and SecurePass, run on separate infrastructure and remain unaffected.
Earlier this week, news agency PTI reported that the company would exit the website security certification business following the incident.
In a statement, the company said, "eMudhra Limited, a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business." The statement added, "There were no end-entity certificates issued out of the affected CA's. Its infrastructure was not compromised, and no data was breached. All physical and logical security controls remained intact."
Responding to the incident involving eMudhra's global SSL/TLS certificates, its chairman V Srinivasan said the company acted diligently, revoked the affected CAs within 14 hours of discovering the issue and disclosed the matter promptly. Srinivasan added that global SSL/TLS is a small part of the company’s business and accounts for roughly one per cent of its global revenue.
"Due to increasing data sovereignty and compliance requirements, complexity and cost associated with this business are increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI (return on investment) of this line of business has also been considerably reduced for eMudhra when measured against our cumulative revenue base," the statement continued.
eMudhra provides digital-signature and website-security certificates that help establish secure browser connections for publicly accessible sites. SSL and TLS certificates are global protocols used to authenticate websites and secure online communications; sites using them generally have URLs beginning with “https”.
Swati Gandhi is a digital journalist with over four years of experience, specialising in international and geopolitical issues. Her work focuses on foreign policy, global power shifts, and the political and economic forces shaping international relations, with a particular emphasis on how global developments affect India. She approaches journalism with a strong belief in context-driven reporting, aiming to break down complex global events into clear, accessible narratives for a wide readership.<br><br> Previously, Swati has worked at Business Standard, where she covered a range of beats including national affairs, politics, and business. This diverse newsroom experience helped her build a strong grounding in reporting, while also strengthening her ability to work across both breaking news and in-depth explanatory stories. Covering multiple beats early in her career has helped her be informed about her current work, allowing her to connect domestic developments with wider international trends.<br><br> At Live Mint, she focuses on international and geopolitical issues through a business and economic lens, examining how global political developments, foreign policy decisions, and power shifts impact markets, industries, and India’s strategic and economic interests.<br><br> She holds a Bachelor’s degree in English (Honours) from the University of Delhi and a Master’s degree in Journalism and Mass Communication from Guru Gobind Singh Indraprastha University. Her academic training has shaped her emphasis on precision, analytical rigour, and clarity in writing. Her interests include global political economy and the intersection of geopolitics with business.<br><br> Outside work, Swati focuses on exploring her passion and love for food. From fancy cafes to street spots, Swati explores food like a true foodie.
Get Latest real-time updates
Catch all the Business News , Corporate news , Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
More
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.