eMudhra to exit SSL business amid cyber security scrutiny

On Thursday, eMudhra announced its decision to exit the global SSL/TLS certificate business, a day after vulnerabilities were made public in the security keys issued by the digital authentication services company. The security lapse triggered a global cybersecurity alert and led to major internet browsers blocking the compromised certificates. The company is licensed under the Ministry of Electronics and Information Technology (MeitY) to issue web security certificates for Government websites, including the income tax portal.

In a filing with the Bombay Stock Exchange, the company said it is voluntarily withdrawing from the global SSL/TLS certificate business because of escalating compliance costs, limited commercial returns, and the scrutiny it has faced after a recent incident.

In its filings, the company claims global SSL/TLS accounts for only around 1 per cent of its revenue. It quotes the company chairman, V Srinivasan, who says the business has been under pressure from increasing data sovereignty requirements, operational complexity, and the fact that big providers offer free certificates. As a result, the filing says the business has seen a reduction in its potential and return on investment relative to the rest of eMudhra’s revenue.

Srinivasan pointed out that the media attention generated by the incident was completely out of proportion to SSL/TLS’s role in the company’s overall business. After extensive board-level discussion, eMudhra decided that exiting the business is in the company’s and its shareholders’ interest. “For many CAs, SSL/TLS is their entire business. For eMudhra, it is just one part of a much wider range of digital solutions and trust services,” he said.

The company will shift its focus and resources to its core enterprise solutions and other trust services, rather than SSL/TLS. All other operations are unaffected. Global digital signature certificates, eSign, and signing services (including those in India) will continue as normal. The enterprise PKI platforms (emCA, CertiNext), the emSigner eSignature suite, and the identity and authentication solutions (SecurePass, emAS) are completely independent of the global SSL/TLS infrastructure and are operating as normal.

eMudhra’s G1 RSA roots will remain available through the end of the transition, the company added. It will work with browser root programmes and customers to ensure a smooth exit.

eMudhra will contact affected customers and provide free replacement certificates through its partners. In contrast, it added that certificate revocation and status services will continue until all issued certificates have expired or been replaced.

This decision follows an incident involving the company’s global SSL/TLS certificates. The affected CAs were revoked within 14 hours of being discovered, and the company shared the news right away. These CAs did not issue any end-entity certificates. Emudhra confirmed that its infrastructure was not compromised, no data was breached, and all security controls remain in place.