eMudhra appoints KPMG to conduct independent review of TLS certificate incident

Digital trust and cybersecurity solutions provider eMudhra has appointed KPMG as an independent external reviewer to examine the recent TLS certificate incident, the company said in a regulatory filing.

The appointment follows the company's earlier commitment to commission an independent assessment of the incident, announced in a press release dated October 21, 2026.

Also Read: AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months


The review will examine the matter and provide clarity on the incident. It will also identify corrective measures and help strengthen the company's governance and compliance framework.

The move comes after eMudhra withdrew from global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business after an anonymous researcher, identified as "Wayne", flagged weak private keys associated with eight certificate authorities (CAs). Browsers, including Google Chrome and Mozilla Firefox, subsequently blocked the affected certificates.

Also Read: Fintechs to lay out a code for technology vendors amid rising cyberthreats and security risks

The weakness had reportedly remained undetected for around 18 months and had persisted through two external audit cycles before the researcher alerted the company and browser operators.