New Delhi

Digital trust and cybersecurity solutions provider eMudhra Ltd reported a 19.6 per cent year-on-year increase in total income to Rs 209.3 crore in the second quarter ended September 30, 2026, while the company said the security incident involving its TLS certificate business affected 1 per cent of its revenue.

The company's total income stood at Rs 174.9 crore in the corresponding quarter of the previous year.

Its EBITDA rose 21.6 per cent to Rs 51.3 crore during the quarter, with an EBITDA margin of 24.5 per cent. Net profit increased 26.3 per cent to Rs 33.4 crore.

For the first half of the financial year, eMudhra reported total income of Rs 401.8 crore, registering a growth of 23.4 per cent. Its net profit rose 27.1 per cent to Rs 65.4 crore.

The company's Enterprise Solutions business remained a key growth driver, with revenue from the segment increasing 36 per cent. It now accounts for 66 per cent of eMudhra's total income.

During the quarter, the company added its first customers in Kazakhstan and Nigeria. It also secured three large enterprise clients in Europe through cross-selling opportunities with Cryptas.

The results come as the company is reshaping its business focus following a security incident involving its global website security business.

The incident involves the company generating cryptographic keys for eight intermediate Certificate Authorities as part of its global Transport Layer Security (TLS) business. 

According to eMudhra, a flaw during the key-generation process caused the creation of a set of weak keys. The issue came to light in October 2026 after an independent security researcher discovered that the weak private keys could be recovered from the corresponding public keys. 

This raised concerns because private keys are used by certificate authorities to issue digital certificates that help browsers verify the identity of websites and establish secure connections.

The eight affected certificates included six TLS intermediate certificates and two code-signing certificates. However, eMudhra said none of the affected intermediate authorities had issued end-entity certificates. 

The company also maintained that its infrastructure had not been compromised and no data breach had occurred.

Following the disclosure, major browser and technology companies, including Google, Apple, Microsoft and Mozilla, took steps to distrust or block the affected certificates. eMudhra said it revoked the affected intermediate certificates and was working with customers to provide replacement certificates.

V Srinivasan, Executive Chairman, said, “We revoked the affected intermediary certificates. There were no end-entity certificates issued out of the affected intermediary CA's. Our infrastructure was not compromised, no data was breached, and all physical and logical security controls remain intact. We appointed KPMG as an independent external reviewer."

READ MORE: Burn survivor Parveen Khan turns her ordeal into a mission to help others

He added, “The business potential and RoI of this line of business have been considerably reduced for eMudhra when measured against our cumulative revenue base”.