eMudhra: What happened to India's biggest digital signature seller?

Small cap Digital trust software 20 October 2026 · 38 min read · Part 1: 5 min · By Pranami Hayaran

What the company does

Company filings, tender bids and some tax returns in India are signed online with a digital signature certificate, a small file usually kept on a USB token. eMudhra is licensed by the Controller of Certifying Authorities (CCA) to issue them, and over the years it has added one-time Aadhaar signatures, the padlock certificates websites use, signing software for governments and banks, and an IT services business in the US. In FY26 it had sales of ₹701.6 crore and a profit after tax of ₹107.8 crore. It employs 861 people and is based near Bengaluru airport. The Executive Chairman, V. Srinivasan, and his family own 54.4%, and the shares have been listed on the NSE and BSE since 1 June 2022.

Summary

This week browsers stopped trusting some of eMudhra's website certificates, and it is quitting that business. A researcher found that the secret keys behind 8 of its certificates were easy to guess, so on 20 October 2026 Mozilla, which makes Firefox, dropped one of its 2 master certificates and Chrome said it would too. eMudhra says it will leave that business, which brings in about 1% of revenue, but it also warned of damage to its reputation that cannot be measured.
A 2024 rule change hurt certificate sales. Since 15 July 2024 each certificate has to be sold to the buyer at 1 published price, and when eMudhra stayed at ₹1,500 while newer rivals charged ₹600 to ₹800, it sold 40% to 50% fewer. Its May 2026 investor deck quoted Frost & Sullivan, a research firm, for a 38% market share, while management's own estimate, given to its rating agency nearly 8 weeks later, was around 30%.
Much of the FY26 jump in certificate revenue is an accounting change. Trust revenue, as the accounts call the certificate business, rose 32.3%, and almost half of that rise, 45%, came because the commission paid to partners, the chartered accountants who sell the certificates, is now added to sales and then taken out again as a cost. Leave that out and it was ₹104.0 crore, barely more than the ₹102.6 crore of 2 years earlier, and the certificate business still makes less profit than it did in FY24.
Nearly half of FY26's growth came from buying a company in Europe, and margins have fallen. Revenue rose 35.1% in FY26, and ₹85 crore of the ₹182.2 crore increase came from Cryptas, an Austrian company bought in July 2025, while the US IT services business grew just 0.1%. The EBITDA margin, the share of revenue left after running costs, has slid from 36.7% in FY22 to 22.7% in FY26.
Reported profit is not turning into cash. In FY26 eMudhra treated ₹103.2 crore of development spending as an asset rather than a cost, and once that and its acquisitions were paid for, ₹115.4 crore more cash went out than came in, as it has for 5 years running. It calls itself debt-free and held ₹126.8 crore of cash and investments at March 2026, but it had also borrowed ₹23.9 crore, part of it from the chairman and his family's company.
Some deals involve the chairman's family, and a 2010 sale is being disputed again. In FY26 eMudhra bought ₹16.5 crore of goods from Bluesky Infotech, a firm owned by the chairman's son and a relative. Separately, 3i Infotech, which started eMudhra, accuses the chairman of fraud over the 2010 sale of the company and wants more than ₹128 crore; the police closed the case in August 2026 as a civil matter, but complaints to SEBI, the markets regulator, are still open.

Why this company, why now

This week. On 17 October 2026 a researcher showed that the secret keys behind 8 eMudhra certificates were so weak that each was a number below 256, so anyone could work them out. Whoever has such a key can make website certificates that browsers accept. eMudhra cancelled the 8 the next day. On 20 October Mozilla took one of eMudhra's 2 master certificates out of Firefox, Chrome said it would follow, and eMudhra stopped using it, which means about 30,000 customer certificates have to be replaced. The other master certificate is still trusted for now.

eMudhra says it was not hacked, no data was taken, and its Indian certificate and eSign businesses run on separate systems. On 22 October its board decided to leave the global website certificate business. Mozilla's review is still open, and Chrome has asked eMudhra for more answers. Why this matters: eMudhra's pitch rests on browsers trusting it (Competitive advantage), and this week 1 of its 2 master certificates lost that trust in Firefox, with Chrome to follow.

eMudhra depends on a licence from the CCA, its regulator, and in 2 years the CCA has changed the rules 3 times.

The trigger. On 15 July 2024 the CCA stopped certifying authorities, the licensed issuers such as eMudhra, from selling certificates in bulk to partners, who had resold them for whatever they could get. The certifying authority now bills the end user at 1 published price and pays the partner a commission, which the annual report calls a change in business model imposed by the CCA. On 15 July 2025 the CCA told every government portal to accept a certificate from any licensed authority, so big issuers lost the edge of portals that took only a few (CCA advisory). Then it set 21 September 2026 as the last day to issue a certificate on an older type of token. eMudhra had no new tokens ready to sell in the June 2026 quarter, and trust revenue, which also covers eSign (one-time Aadhaar signatures) and website certificates, fell 3% from a year earlier.

eMudhra's share hit its low in March 2026, then recovered

eMudhra's closing share price on NSE, October 2025 to October 2026. It fell 7% the day 3i Infotech's complaint was disclosed, and rose after the police closed it in August.

₹ per share, closing price

30 March 2026: ₹374, the year's low

NSE end-of-day prices · 15 October 2025 to 19 October 2026

What the company tells investors. The company says it has moved on from certificates. Its deck pitches a trust platform for the age of AI and post-quantum encryption, built to resist quantum computers, and points to ₹238 crore of software orders under contract for FY27, up about 25%. Management expects 18% organic growth in FY27, before any acquisitions.

Who has been buying and selling. Alternative investment funds, pooled funds for wealthy investors that are not mutual funds, held 75,46,770 shares in December 2025 and 16,64,006 by September 2026. Small investors went the other way, from 9.19% of the shares to 13.02%. The family has not sold a share in the market since the IPO, the company's first public share sale in 2022 (Promoters).

Where the filings differ. The decks give eMudhra 38% of the certificate market by value, a 2024 Frost & Sullivan figure, while the rating agency, quoting management's own estimate, says around 30%. The press release says debt-free, but the notes list loans from the chairman. FY25 EBITDA was ₹132.4 crore in one deck and ₹124.8 crore in the next. The open question is what is left of the certificate business, and what has replaced it.

Results for the September 2026 quarter, the peak season for certificates and the first quarter to end after the token deadline, are due on 4 November 2026.

History

eMudhra started in 2008 as 3i Infotech Consumer Services, set up by 3i Infotech, then an ICICI group software company. It got its certifying authority licence the same year, when V. Srinivasan was 3i Infotech's managing director.

December 2010. 3i Infotech sells the company to Indus Innovest, run by Ravi Jagannathan, for ₹29.88 crore, and turns the ₹25 crore it was owed into preference shares, a kind of share that pays a fixed dividend. Renamed eMudhra Consumer Services.
January 2014. Srinivasan, who left 3i Infotech in 2012, takes charge once the business is split with Jagannathan. "from January 2014, I started actively managing the company", he told investors in 2026.
2014 to 2015. Renamed eMudhra Limited. A court-approved merger of Indus Innovest and Taxsmile into the company gives Srinivasan control on 6 November 2015. It becomes the first eSign provider in India, issuing one-time Aadhaar signatures.
2017 to 2018. Launches emCA, software for running a certifying authority. After a WebTrust audit, the yearly check browser makers require, browsers accept its own emSign root certificates, the master certificates its others rely on.
May 2022. Sells 16,03,617 shares at ₹243.20 to Baring, Acacia and Motilal Oswal funds before the IPO.
June 2022. The IPO at ₹256 raises ₹412.79 crore, of which ₹161 crore is new money and ₹251.79 crore goes to shareholders who sold. Listed on 1 June 2022.
2023 to 2024. Buys 51% of Ikon Tech, a Houston IT services firm, in 2023. Raises ₹200 crore from a share sale to institutions in January 2024, then buys TWO95, a New Jersey IT services firm, and Sendrcrypt, a US email security start-up, in mid 2024.

The last 2 years are under Recent developments.

How the business works

How an eMudhra certificate is licensed, sold and renewed

A digital signature certificate starts with a licence. The CCA licenses each certifying authority for 5 years and audits it yearly, and eMudhra's runs to 6 November 2028. For its certificates to work in Chrome, Safari or Windows, its root, or master, certificate has to be on each browser maker's trusted list, which takes a yearly WebTrust audit.

The buyer is usually a company director, a chartered accountant's client or a bidder in a government tender, who needs to sign a company filing, an audited tax return, a GST return or a tender. A partner, usually a chartered accountant, checks their identity by video and Aadhaar. eMudhra issues the certificate from its own data centres, and the key goes on a USB token it buys in. The certificate lasts 1 or 2 years and is then renewed.

How the money is earned. Since July 2024 there is 1 published price. eMudhra charges ₹1,500 for a 2-year certificate and pays the partner who brought the customer 40%, plus 10% to the master partner above them. Before, it sold certificates to partners in bulk at ₹270 to ₹300 each, and partners resold them for whatever they could get. The cash comes in when the certificate is sold. Issuing 1 more costs almost nothing, and management puts the gross margin before commission, what is left of the price after the cost of issuing, at 98% to 99%. So what eMudhra keeps from each sale depends on the commission it pays, not on the cost of issuing.

Aadhaar eSign is different. The signer proves who they are with an Aadhaar one-time password (OTP), and eMudhra issues a certificate good for that 1 signature. It earns about ₹5 a signature. eSign sold to banks and fintechs counts as software revenue, not trust.

Software is sold project by project. A bank or a government buys a licence for emCA (to run its own certifying authority), emSigner (paperless signing), SecurePass (log-in and access control) or CertiNext (finding and renewing every certificate on its servers), pays to have it installed, then pays for support each year. Revenue on a licence is booked once the licence is made available, so much of it is earned before it is billed.

The US services business is people: consultants placed with American companies and billed by the hour or the project.

Who holds the power. In certificates, power sits with the regulator, which sets the rules, and with the chartered accountants, who decide which authority their clients go to. In software it sits with the buyer, because banks and governments run long tenders and pay slowly.

Products and segments

Revenue of eMudhra's 3 segments, FY22 to FY26

The audited accounts have 3 segments: Trust Services (certificates and eSign), Enterprise Solutions in India, and Enterprise Solutions outside India, which holds the US services. The investor deck splits it differently: Enterprise Solutions 59%, Services 21% and Trust 20% of revenue.

Which one earns the margin. Software in India keeps 57.5% of revenue before shared costs, though it is only 18% of the total. The overseas segment is the largest, 62% of revenue, and earns the least, 21.9%, down every year from 52.1% in FY23 as it bought US services firms. Trust's margin fell from 62.9% in FY22 to 31.4%.

Trust, net of the rule change. Since July 2024 trust revenue includes the commission partners used to keep, booked again as a cost: ₹20.6 crore in FY25 and ₹36.0 crore in FY26. Take it out and trust revenue went from ₹102.6 crore in FY24 to ₹85.3 crore in FY25 and back to ₹104.0 crore in FY26.

Trust revenue, as reported and net of partner commission

Why this matters: the certificate business sold about as much in FY26 as in FY24, in a year when the reported figure rose by a third.

eSign is where the volume is. Certificates and eSign make up 94% of trust revenue, and website certificates the rest. Across India, eSign has grown 7 times since 2020, while USB-token certificates have stayed flat (Industry size and structure).

What management is pushing. The first bet is CertiNext, which it sells on a browser rule that will cut website certificate life to 47 days by 2029, so companies will have to renew certificates far more often. The others are encryption meant to resist quantum computers, identity checks for AI software agents, growth in Europe through Cryptas, and a trust licence in the UAE. None of these has its own revenue line yet. eMudhra says CertiNext is among the products that are not affected by its exit from website certificates.

Customers

Certificates. eMudhra counted about 1.2 lakh partners in its July 2024 investor deck, mostly chartered accountants, and has not given a newer count. The biggest was Bluesky Infotech, a firm in the promoter group (the controlling shareholders), which brought 14.02% of revenue in FY19 (Related-party transactions). After the July 2024 rule, about 180 to 200 of the larger partners moved to other authorities, and eMudhra raised commission to 45%, 50% and 55% for some who stayed. The tax department now lets most taxpayers sign an audit report with an Aadhaar OTP, so of about 36 lakh tax audit cases, management estimates only 6 to 7 lakh still need a certificate.

Software. eMudhra had 1,374 enterprise customers in FY26, 240 of them new. Existing customers brought 67% of enterprise revenue. By sector, government and defence made up 32%, banks and insurers 27%, other companies 41%. The 2022 prospectus named Infosys, Hindalco, Mashreq Bank, JSW Steel and TCS among its customers, but later filings name none.

Its biggest customers matter less. The top 10 made up 39.0% of revenue in FY23 and 22% in FY26.

Who pays late. Government buyers in India take 6 to 9 months to pay, and in rare cases 1 to 2 years. The company set aside ₹5.0 crore in FY26 for debts it may not collect, against ₹2.2 crore the year before, and wrote off ₹3.4 crore.

eMudhra has not given the exchanges a value for any contract win. The decks describe wins without naming the buyer: a Kenyan regulator, a UAE police force, an Indian tax department.

Costs and inputs

The largest cost, ₹238.3 crore of "other direct operating expenses", is 34% of revenue, and the annual report never breaks it down. It was ₹25.5 crore in FY23. It covers the US consultants, software it resells and transfer prices, what eMudhra's own companies charge each other. Why this matters: the cost that grew fastest is the one a reader cannot see into.

Tokens. The USB tokens are bought in and earn about 10% gross margin. With the move to a newer token standard due in September 2026, eMudhra had none to sell in the June 2026 quarter.

People. The group employed 851 people a year earlier and 861 now. The parent company's own staff fell from 733 in FY24 to 604 in FY26, and 35.20% of its staff left during FY26. Employee costs were 19.8% of revenue. So the parent is shrinking and lost about a third of its staff in FY26, while the group's headcount holds steady through the companies it has bought.

Fixed and variable. Certificates cost almost nothing extra to issue, so when volume falls, profit falls faster. US services are the opposite, since cost moves with every hour billed. The mix has moved towards the second.

Interest and tax. Interest was ₹5.1 crore. The tax rate was 16.2%, well below India's standard company rate, because most of the profit was earned in eMudhra's companies in Dubai and Singapore (Corporate structure).

Pricing power

In certificates eMudhra has had little control over price, as the last few years show.

What partners paid fell by more than half, then rose again. A 2-year certificate cost partners about ₹375 in early 2021, ₹180 by October 2022 and about ₹140 by May 2023. In September 2023 eMudhra raised it 2.5 times, and rivals only partly followed.

The rule set the price, and rivals undercut it. From July 2024 eMudhra published ₹1,500 for a 2-year certificate. About 10 to 12 new competitors sell for less and pay partners 50% to 60%. In February 2026 rivals were still at ₹700 to ₹800, and management said volume may not grow much. It has chosen not to cut price. Why this matters: holding the price kept the margin on each certificate and gave up volume.

The cycle. 35% to 40% of a year's certificates are sold in the July to September quarter, when audited tax returns and company filings are made. A weak September quarter cannot be made up later in the year.

Software and website certificates. The most basic website certificates are given away free by Let's Encrypt, a non-profit, so eMudhra competes on the paid kinds, priced at USD 6 to 50 a year, a global business it decided on 22 October 2026 to leave (Why this company, why now). In software, the India segment's margin shows the company can still charge for what it builds itself.

Operations and capacity

Campus. The eMudhra Digital Campus sits in the aerospace park near Bengaluru airport, on 12,140 square metres of state land leased for 99 years. It opened on 1 April 2022, built with bank loans that the IPO repaid.

Data centres. The IPO raised ₹46.4 crore for data centres in Bengaluru, Chennai and abroad. The Dutch one, built in FY24 for ₹15.8 crore, was closed and its servers moved to the US. A new UAE law requires a centre there, and in July 2026 the company called that one complete. FY26 spending on data centres and servers was ₹21.3 crore.

Where the revenue is earned. By the deck's count, India brings in 36%, then North America 34%, Europe 12%, the Middle East and Africa 11%, Asia Pacific 7%. The parent's exports were only 2.07% of its turnover, because foreign sales are booked in the subsidiaries.

Certificates held. Besides the CCA licence and the yearly WebTrust audit, emCA holds EAL 4+, an international security grade, and the company holds ISO and SOC 2 certifications, the international and US standards for how a company guards its data. In Europe, the qualified trust status EU law requires for legally binding e-signatures belongs to PrimeSign GmbH, not eMudhra Limited. PrimeSign has held it since 6 May 2018 and is owned by Cryptas, of which eMudhra owns 51%. In July 2026 the company said its UAE trust services were expected to launch in the September 2026 quarter, with its licence application with TDRA, the local regulator.

Browser trust. eMudhra's 2 main root certificates, emSign Root CA G1 and emSign ECC Root CA G3, were both trusted by Apple, Chrome, Microsoft and Mozilla, and its deck calls it the only Indian authority with that standing. Its newer single-purpose roots have waited for Mozilla's approval since April 2024. On 19 October 2026 eMudhra asked Mozilla for the full removal of its 2 older US roots, C1 and C3, as planned housekeeping. Between 18 September and 16 October 2026 Mozilla's tracker logged 7 new compliance reports against it, each filed when an authority breaks a browser rule, and 2 of them concern a new certificate authority it runs for US universities. None of those reports led a browser to drop it; the weak keys found in October 2026 did (Why this company, why now).

Opening the rest…

Free account

A 6-digit code by email, no password. You also get The Macro Brew and The Edge Alert by email.

Already signed up? Use the same email to sign in.