eMudhra Quits Global SSL/TLS Business After Security Glitch
eMudhra to withdraw from the global SSL/TLS certificate market following a security incident and rising operational costs.
Digital trust services giant eMudhra Limited has announced its decision to voluntarily exit the global SSL/TLS certificate market. This strategic withdrawal comes in the wake of a recent security incident and a growing realization that the segment is no longer commercially viable due to escalating costs and operational hurdles.
The Security Incident That Triggered the Move
The decision follows a security vulnerability that came to light on October 17. A researcher discovered vulnerable private keys associated with eight intermediate digital certificates under eMudhra's global Public Key Infrastructure (PKI). After the researcher flagged these vulnerabilities to tech giants like Google and Mozilla, the affected certificates were promptly blocked.
Responding to the crisis, V Srinivasan, Chairman of eMudhra Limited, stated that the company acted swiftly, revoking the impacted Certificate Authorities (CAs) within 14 hours of the discovery. The company has clarified several key points regarding the breach:
- No Data Breach: The company maintains that its infrastructure was not compromised and no data breach occurred.
- No End-User Impact: No end-entity certificates were issued by the affected CAs.
- Security Intact: All physical and logical security controls remained fully functional during the incident.
Why the Business Was No Longer Viable
While the security incident acted as a catalyst, eMudhra revealed that the global SSL/TLS business had become a burden. The company cited several systemic challenges that made the segment unattractive:
- Rising Costs: Increasing operational expenses and the heavy burden of regulatory compliance.
- Data Sovereignty: Stricter and more complex data sovereignty requirements globally.
- Free Competition: The rise of large entities offering SSL/TLS certificates for free has severely diminished the return on investment.
Interestingly, eMudhra noted that the social media attention following the security incident was disproportionate to the segment's actual importance to the company. The global SSL/TLS business accounts for only about 1 per cent of eMudhra's total global revenue.
Core Operations Remain Untouched
The company was quick to reassure its stakeholders that this exit does not impact its primary business lines. The following services remain fully operational and unaffected:
- Digital Signature Certificates (DSC)
- eSign services
- Enterprise Public Key Infrastructure (PKI)
- Electronic signatures and identity authentication businesses, including all Indian operations.
The Road Ahead: Transition and Focus
Moving forward, eMudhra intends to sharpen its focus on its core enterprise solutions and trust services. To ensure that current customers are not left stranded, the company has outlined a transition plan:
The G1 RSA roots will continue to serve customers until the exit process is finalized. eMudhra will work closely with browser programs and affected clients to provide free certificate replacements through its partners. Furthermore, certificate revocation and status services will stay active until all issued certificates have either expired or been replaced.
As part of its final commitments to browser root programs, eMudhra has pledged to submit a comprehensive root-cause report regarding the security incident.