eMudhra to Exit Global SSL/TLS Certificate Business After Security Incident
NEWZA Editorial Team•
⚡ Key Financial Takeaways
eMudhra’s board voted to exit the global SSL/TLS certificate business, a segment contributing roughly 1% of its total revenue.
A security incident on Oct 17 exposed vulnerable private keys in eight intermediate certificates, leading Google and Mozilla to block them.
The company revoked the affected Certificate Authorities within 14 hours, reported no data breach and said no end‑entity certificates were issued.
Rising data‑sovereignty regulations, compliance costs and free‑certificate competition were cited as reasons for the withdrawal.
eMudhra will continue supporting existing certificates via its G1 RSA roots and will coordinate free replacements with browser programmes and partners.
💡 Why It Matters
The decision underscores the growing challenges of operating in the SSL/TLS market, where compliance burdens and free‑certificate competition are squeezing margins. For eMudhra, exiting a low‑revenue segment allows resources to be redirected toward higher‑value enterprise PKI and digital‑trust services, potentially strengthening its position in India's burgeoning digital‑identity ecosystem.
Security incident triggers swift response On 17 October, a security researcher reported that private keys for eight of eMudhra’s intermediate digital certificates were vulnerable. The disclosure prompted Google and Mozilla to block the certificates. eMudhra’s Chairman V Srinivasan said the company revoked the affected Certificate Authorities within 14 hours, confirming that no end‑entity certificates had been issued, its infrastructure remained uncompromised and no data breach occurred.
Board decides to pull out of SSL/TLS market Following the incident, eMudhra’s board concluded that staying in the global SSL/TLS certificate business was no longer in the best interests of shareholders. The segment, which generates about 1 % of the company’s worldwide revenue, faces mounting compliance obligations, higher operational costs and eroding profitability, especially as large providers offer certificates for free.
Rationale behind the withdrawal Chairman Srinivasan highlighted three pressures: stricter data‑sovereignty requirements, escalating regulatory compliance costs, and the competitive squeeze from free‑certificate issuers. He also noted that social‑media attention had amplified scrutiny far beyond the segment’s modest contribution to overall earnings.
Transition plan and continued services eMudhra will keep its G1 RSA root certificates active to serve customers while the wind‑down proceeds. It will work with browser programmes and affected clients to provide free replacement certificates through partner networks. Certificate revocation and status‑checking services will stay operational until all existing certificates either expire or are replaced. The company reaffirmed that its other digital‑trust offerings—digital signature certificates, eSign, enterprise PKI, electronic signatures and identity authentication—remain unaffected.
Looking ahead The firm pledged to fulfil remaining obligations to browser root programmes, including submitting a comprehensive root‑cause report. Management indicated a sharpened focus on core enterprise solutions and non‑SSL/TLS trust services as the next growth avenue.
🏛️ Background & Context
SSL/TLS certificates underpin encrypted web traffic. Over the past few years, free providers such as Let’s Encrypt have dramatically increased market pressure on traditional commercial CAs. Simultaneously, regulators worldwide are tightening data‑localisation and security‑compliance rules, raising operational costs for certificate authorities that serve a global customer base.
👁️ What To Watch Next
Watch for the rollout of free replacement certificates to eMudhra’s existing customers, the timeline for de‑commissioning the SSL/TLS business, and any regulatory feedback on the company’s compliance measures. Analysts will also monitor how eMudhra reallocates capital toward its enterprise PKI and digital‑signature services.
