eMudhra statement on distress of select Global TLS Intermediate and one Root CA

EL/SEC/2026-27/62 October 21, 2026 Corporate Relationship Department The Manager, Listing Department BSE Limited National Stock Exchange of India Limited 1st Floor, New Trading Ring Rotunda “Exchange Plaza”, C-1, Block G, Building, P J Towers, Dalal Street, Fort, Bandra-Kurla Complex, Bandra (E), Mumbai - 400 001 Mumbai - 400 051 Script Code: 543533 Symbol: EMUDHRA Dear Sir/Madam, Sub: Press Release Please find enclosed the Press Release titled “eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA” This information will also be hosted on the website of the company at www.emudhra.com This is for your information and records. Thanking you Yours faithfully, For eMudhra Limited Johnson Xavier Company Secretary & Compliance Officer Membership No. A28304 Encl.: As Above PRESS RELEASE eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA India DSC and eSign businesses unaffected; no infrastructure compromise or data breach Bengaluru, October 21, 2026 – eMudhra Limited (NSE: EMUDHRA | BSE: 543533) today issued a statement on recent reports about the distrust of some of its intermediate Certificate Authorities (CAs) used in its global TLS business. What happened The matter concerns 8 of eMudhra’s several intermediate CAs that were trusted as part of its Global TLS business. These issuing CAs were created under eMudhra’s ECC root in a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs). A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause. These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025. Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques. The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla. No compromise of infrastructure or data eMudhra confirms that: • Its infrastructure was not compromised. • No data was breached. • All physical and logical security controls remained intact. No impact on India DSC and eSign businesses This incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally. Limited commercial impact The affected global TLS business is a very small part of eMudhra’s operations and accounts for around 1% of the company’s revenue. However, this may have some reputational risks on eMudhra which cannot be quantified. Customer support and next steps eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation. About eMudhra With over 17 years of expertise, eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI), enterprises, and governments across more than 35 countries worldwide. Its product suite spans CertiNext (PKI and certificate lifecycle management), SecurePass (identity and access management, multi-factor authentication and converged identity), and PrivaTrust (data discovery and consent management for global data-privacy compliance and DSARs), delivering high-assurance digital trust at population scale. Press Contacts: eMudhra | sudesh.k@emudhra.com