Bengaluru: Indian digital trust services major eMudhra Limited has decided to walk away from its global SSL/TLS certificate business, in a dramatic fallout from a security incident that rocked the global web-security community earlier this month.
The company announced on Thursday, October 22, that its board of directors has decided to voluntarily withdraw from the global SSL/TLS certificate business. eMudhra is listed on the BSE (543533) and NSE (EMUDHRA).
The decision follows a security incident involving eight intermediate digital certificates under eMudhra’s global public key infrastructure (PKI). The issue first surfaced on October 17, when a researcher flagged weak and vulnerable private keys to Google and other parties. Google and Mozilla responded by blocking the affected certificates, and on October 19 the eight intermediate CA certificates were formally revoked.
Addressing the matter, chairman V Srinivasan said the affected certificate authorities were revoked within 14 hours of the discovery. He emphasised that no end-entity certificates were issued from the affected CAs, that the company’s infrastructure was not compromised, that no data was breached, and that all physical and logical security controls remain intact.
The company cited a combination of reasons for the exit: rising compliance costs, operational complexities and declining commercial viability of the global SSL/TLS business. Data sovereignty requirements are increasing globally, and the fact that large entities now offer SSL/TLS certificates for free has eroded the return on investment. The board also noted that social media amplification of the incident had brought disproportionate scrutiny.
To put the move in perspective, the global SSL/TLS business contributes only about 1 per cent of the company’s global revenue. Its core businesses — enterprise solutions, digital signature certificates (DSC), eSign and enterprise PKI — remain unaffected by the decision.
For existing customers, the transition will be managed carefully. eMudhra said its G1 RSA roots will continue serving customers through the process, with coordination planned with browser programmes and free certificate replacements offered via partners.
The incident has also drawn government attention. The Ministry of Electronics and Information Technology (MeitY) has formed a special investigation team involving officials from the Controller of Certifying Authorities (CCA), CERT-In, Aadhaar and NPCI to probe the incident, according to a morning report from BusinessLine.
For India’s cybersecurity ecosystem, the episode is a sobering reminder that digital trust is hard-won and easily shaken — and that even the custodians of trust must constantly earn it. Industry watchers say the voluntary withdrawal, while painful, may help eMudhra refocus on its higher-margin domestic and enterprise businesses, where its roots in India’s digital-signature ecosystem run deepest. The coming weeks will show how smoothly the transition plays out for the customers who trusted eMudhra’s certificates — and whether the broader industry draws the right lessons about transparency when things go wrong.
