Digital authentication services company eMudhra has decided to voluntarily exit the global Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate business following a security vulnerability involving weak cryptographic keys issued by some of its certification authorities.
The decision comes after Apple, Google, Microsoft and Mozilla blocked eight eMudhra issuing certificate authorities (CAs) over concerns about the strength of their cryptographic keys. The company announced the withdrawal on Thursday, citing increasing compliance requirements, operational complexity and declining business potential in the segment.
Following the announcement, eMudhra’s shares fell 20% to hit the lower circuit at ₹345.25 on the BSE.
eMudhra Says Incident Was Contained
In a statement, eMudhra Chairman V Srinivasan said the company had addressed the incident by revoking the affected certificate authorities within 14 hours of discovering the issue and disclosing the matter promptly.
The company said no end-entity certificates had been issued through the affected certificate authorities. It also stated that its infrastructure had not been compromised, no data had been breached, and all physical and logical security controls remained intact.
SSL/TLS certificates help establish secure connections between websites and browsers. Websites using these certificates generally display addresses beginning with “https”, indicating that the connection is encrypted.
Weak Cryptographic Keys Triggered Security Concerns
The incident came to light after a cybersecurity researcher alerted Apple, Google, Microsoft and Mozilla to vulnerabilities involving weak cryptographic keys issued by eMudhra’s certification authorities.
According to the reported findings, eight issuing CAs had been created using cryptographic keys that were weaker than required. The vulnerability raised concerns that malicious actors could potentially reverse-engineer the keys and create fraudulent websites impersonating legitimate payment platforms, potentially exposing users to financial fraud or data theft.
The subsequent blocking of the affected certificates by major browser and technology companies brought increased scrutiny to the company’s website security certification operations.
MeitY Constitutes Team to Investigate Incident
The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the security incident at eMudhra.
The investigation comes amid concerns over the potential implications of the vulnerability for website security and digital trust infrastructure. eMudhra, however, said the impact was limited to the affected certificate authorities and maintained that its broader infrastructure remained secure.
Company to Focus on Core Digital Trust Services
eMudhra said its SSL/TLS certification business accounts for approximately 1% of its global revenue, making it a relatively small component of its overall operations.
The company cited rising data sovereignty requirements, regulatory compliance obligations and the growing complexity and cost of operating in the segment. It also noted that some large players offer SSL/TLS certificates free of charge, reducing the commercial attractiveness and return on investment of the business.
Going forward, eMudhra plans to focus its resources on core enterprise solutions and other digital trust services beyond SSL/TLS certification.
The exit marks a strategic shift for the company as it seeks to concentrate on business segments where it believes it can deliver greater value to customers while navigating the regulatory and security demands of the digital authentication industry.
By: Sanya Sharma
