eMudhra exits global SSL certificate business after security incident

Dubai: Digital security company eMudhra Limited will exit the global website security certificate business following a security incident involving eight intermediate digital certificates, while maintaining that its core operations remain unaffected.

The company's board decided to voluntarily withdraw from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate segment, citing rising compliance costs, operational complexities and declining commercial viability.

The announcement follows concerns raised after a researcher flagged vulnerable private keys on October 17. Google and Mozilla subsequently blocked the affected certificates, according to the company.

eMudhra says core operations unaffected

eMudhra said its global SSL/TLS certificate business accounts for approximately 1 per cent of its global revenue.

V Srinivasan, chairman of eMudhra, said the company revoked the affected certificate authorities within 14 hours of discovering the issue.

The company said the affected authorities had not issued any end-entity certificates and that its infrastructure had not been compromised. It also said there had been no data breach and that its physical and logical security controls remained intact.

These are the company's statements about the incident; the planned withdrawal follows concerns over the affected certificates and the resulting response from browser providers.

Google and Mozilla block affected certificates

SSL/TLS certificates help authenticate websites and establish encrypted connections between browsers and web servers. Browser providers maintain trust programmes to determine which certificate authorities their products recognise.

The October incident involved eight intermediate certificates within eMudhra's global public key infrastructure (PKI). The disclosure prompted action from Google and Mozilla, raising concerns about whether browsers would continue to accept the affected certificates.

The company said social media attention had led to scrutiny it considered disproportionate to the segment's contribution to its overall business.

Rising costs behind withdrawal

Srinivasan said rising data sovereignty requirements, regulatory obligations, and operating costs have made the global SSL/TLS certificate business more complex.

He also pointed to competition from providers offering website certificates free of charge, which has reduced the segment's commercial attractiveness.

After reviewing the situation, the board concluded that withdrawing from the business was in the interests of the company and its shareholders.

Customer transition and certificate replacements

eMudhra said its G1 RSA root certificates would continue serving customers during the transition. The company will coordinate with browser programmes and affected customers to facilitate free certificate replacements through its partners.

Certificate revocation and status services will remain operational until all issued certificates expire or are replaced, it said.

The company also intends to fulfil its remaining commitments to browser root programmes, including submitting a comprehensive root-cause report.

Digital signature and enterprise services continue

eMudhra said the withdrawal would not affect its digital signature certificate (DSC), eSign, enterprise PKI, electronic signature or identity authentication businesses, including its operations in India.

The company plans to focus on these core enterprise solutions and other digital trust services as it completes its exit from the global SSL/TLS certificate market.

With inputs from Agencies