How could the eMudhra certificate security incident affect Infosys?
Infosys may face operational disruption and costs migrating from compromised eMudhra certificates As a reported customer of eMudhra, Infosys must migrate its systems away from the affected SSL/TLS certificates. The vulnerability stemmed from eight cryptographic keys generated by eMudhra in April 2025 that were shortened, making them significantly weaker and easier to break. Because major browsers like Google and Mozilla have stopped trusting these certificates, Infosys faces the operational challenge of replacing these certificates with those from a different, trusted hierarchy to ensure continuity of essential online services.
- Effect
- Strong negative
- How direct
- Stated in the reporting
- When
- Within weeks
- The story
- Mostly repetition
How it reaches Infosys
-
Eight intermediate certification authority keys issued by eMudhra were found to be cryptographically weak due to faulty key generation in April 2025. This vulnerability could have allowed attackers to create fraudulent certificates and facilitate phishing attacks. Consequently, Google, Mozilla, and Microsoft stopped trusting eMudhra's SSL/TLS certificates, and browser providers moved to block the affected certificates.
The full event3independent outlets -
Google and Mozilla stopped trusting eMudhra's SSL/TLS certificates after vulnerabilities were discovered in some of its certificates. This action was taken because the issue was traced to eight cryptographic keys generated by the company in April 2025 that were shortened, making them significantly weaker and easier to break. Infosys is reported to be a customer of eMudhra. Since the certificates used by eMudhra are now untrusted by major browsers, Infosys must undertake the operational task of replacing these affected certificates to maintain secure online communications and prevent service disruption.
1 report connects these two. Brind only summarizes; follow a link to read the reporting itself.
- livemint.com Thursday
-
Indian multinational technology company
Everything about Infosys
Tap any step to see the evidence behind it.
The facts so far
As reported. Each one links to where it comes from.
- eMudhra's customers reportedly include IT companies such as Infosys and TCS, as well as government agencies.livemint.com
- The issue was traced to eight cryptographic keys generated by the company in April 2025.livemint.com
- Google and Mozilla blocked the affected certificates in Chrome and Firefox.livemint.com
Why it matters
For Infosys, as a major IT service provider, maintaining secure digital infrastructure is critical to its operations and client trust. The mandatory migration away from compromised certificates represents a significant operational undertaking, requiring resources and time to ensure that all systems, applications, and websites remain secure and functional under the new trust hierarchy.
This incident highlights the systemic risks within the Public Key Infrastructure (PKI) when a single certificate authority experiences a flaw. While eMudhra maintained that its infrastructure was not compromised, the discovery of weak keys demonstrates how a failure in key generation can force major global players like Google and Mozilla to intervene, impacting any organization relying on that authority for digital trust.
What we don't know yet
- How long will the certificate migration process take for Infosys to complete across all its systems?
- What specific costs are associated with Infosys replacing the affected certificates and updating its infrastructure?
Is this still moving?
- Reports
- 8
- Developments
- 2
- Repetition
- 75%
What would change this answer
Who else could feel it
Other possible ripples from the same event.
Reporting
- livemint.comThursday
- aninews.inThursday
- indiagazette.comThursday
Keep going
Brind's analysis is written by AI from the reporting linked above and can be wrong. This explainer is a possibility worth considering, not a forecast: steps marked as Brind's reasoning are not stated in the reporting. It is not investment advice; do your own research.