Bengaluru (Karnataka) [India], October 22 (ANI): Digital trust services provider eMudhra Limited on Thursday announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business following a recent security incident, citing rising compliance costs, operational complexities and declining commercial viability of the segment.
The decision follows a security incident involving eight intermediate digital certificates under eMudhra's global Public Key Infrastructure (PKI). The issue surfaced on October 17 after a researcher flagged vulnerable private keys to Google and other technology companies, prompting Google and Mozilla to block the affected certificates.
According to a company release, the global SSL/TLS certificate business contributes approximately 1 per cent of eMudhra's global revenue, while its core enterprise solutions and other digital trust services remain unaffected.
V Srinivasan, Chairman of eMudhra Limited, said the company responded promptly to the recent security incident by revoking the affected Certificate Authorities (CAs) within 14 hours of discovering the issue.
The company stated that no end-entity certificates were issued by the affected CAs, its infrastructure was not compromised and no data breach occurred.
It further maintained that all physical and logical security controls remained intact.
Srinivasan highlighted that increasing data sovereignty requirements, regulatory compliance obligations and rising operational costs had made the global SSL/TLS certificate business increasingly complex.
He also noted that several large entities offer SSL/TLS certificates free of cost, reducing the business potential and return on investment for eMudhra.
The company stated that the level of social media attention surrounding the incident had resulted in scrutiny disproportionate to the segment's contribution to its overall business.
Following detailed deliberations, the Board concluded that withdrawing from the global SSL/TLS certificate business was in the best interests of the company and its shareholders.
eMudhra said it would now sharpen its focus on core enterprise solutions and trust services other than SSL/TLS certificates.
To ensure a smooth transition, the company said its G1 RSA roots would continue serving customers until the process was completed.
It will coordinate with browser programmes and affected customers to facilitate free certificate replacements through its partners.
The company also confirmed that certificate revocation and status services would remain operational until all issued certificates expire or are replaced.
eMudhra clarified that its digital signature certificate (DSC), eSign, enterprise public key infrastructure (PKI), electronic signature and identity authentication businesses, including operations in India, remain unaffected.
The company said it would fulfil its remaining commitments to browser root programmes, including submitting a comprehensive root-cause report. (ANI)
eMudhra to exit global SSL/TLS certificate business after security incident, core operations unaffected
