eMudhra exits global SSL/TLS business after security scare: What happened, why shares crashed 20%

Shares of eMudhra Limited will remain in focus on Friday, October 23, after the company announced on Thursday that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business following a recent security incident.

V. Srinivasan, Chairman of eMudhra, said the company had handled the incident diligently, revoking the affected certificate authorities (CAs) within 14 hours of discovering the issue and disclosing it promptly.

“There were no end-entity certificates issued out of the affected CAs. Its infrastructure was not compromised, no data was breached. All physical and logical security controls remained intact,” the chairman said.

Why is eMudhra exiting the global SSL/TLS certificate business?

Srinivasan said the global SSL/TLS certificate business contributes around 1% of eMudhra’s revenue. He added that rising data sovereignty and compliance requirements have increased the complexity and cost of operating the business over the years. Competition from large entities offering SSL/TLS certificates free of charge has also reduced its business potential and return on investment (RoI).

“The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations, our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders,” the chairman said.

He added that while SSL/TLS is the core business for many certification authorities, it represents only one part of eMudhra’s broader digital solutions portfolio. The company plans to focus on its core enterprise solutions and digital trust services beyond SSL/TLS.

What happened earlier this week?

Earlier this week, Indian digital certification authority eMudhra disclosed a security incident involving the compromise of private keys associated with its certificates, according to an advisory issued by the Indian Computer Emergency Response Team (CERT-In), the government’s cybersecurity agency.

CERT-In said the incident involved private keys associated with eight intermediate CA certificates in eMudhra’s public key infrastructure (PKI), comprising six TLS certificates and two code-signing certificates.

The compromised keys could potentially be exploited by cybercriminals to create fraudulent digital identities or impersonate legitimate websites and services, posing a risk to users and organisations that rely on trusted digital certificates.

eMudhra said the incident affected a small part of its global TLS business and had no connection with its Indian Digital Signature Certificate (DSC) or eSign businesses. Government sources also indicated that the impact on its Indian operations was expected to be limited.

The company said it was working directly with potentially affected customers to provide replacement certificates and prevent disruption to critical services. It was also working with root programs and continuing its root-cause investigation.

In its explanation of the incident, eMudhra said a flaw in its system had led to the creation of weak keys alongside the original strong keys. A security researcher had alerted Apple, Google, Microsoft and Mozilla that the weak keys could potentially be reverse-engineered, possibly with the assistance of artificial intelligence (AI).

eMudhra share price trend

Shares of eMudhra tumbled 20% on Thursday following news of the security incident, putting the stock in focus as investors assess the potential reputational and business implications of the episode and the company’s decision to exit the global SSL/TLS certificate business.

What is SSL/TLS certificate business

The SSL/TLS certificate business involves issuing digital certificates that authenticate websites and enable encrypted communication between websites, browsers and apps. These certificates help protect sensitive information, such as login credentials and payment details, during online transactions. Companies earn revenue by issuing and renewing certificates and providing related digital security services.

What else the company said

The company said its G1 RSA roots will continue to serve customers until this transition is complete, as we work with browser programs and our customers to enable this transition.

eMudhra will reach out to affected customers to replace any certificate free of cost from partners through the transition. Revocation and certificate status services will keep running until every issued certificate has expired or been replaced.

eMudhra will complete its remaining commitments to the browser root programs, including a full root cause report.

Core businesses unaffected

eMudhra’s global SSL/TLS infrastructure runs separately from its other operations. The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normal.

About eMudhra

eMudhra provides digital identity, trust and security solutions to banks, financial institutions, enterprises and governments across more than 35 countries. The company has over 17 years of experience and offers products for public key infrastructure (PKI), certificate lifecycle management, identity and access management, multi-factor authentication, data discovery, and data privacy compliance.