Digital trust firm eMudhra said on Thursday, October 22, that its board had decided to exit the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business after Google, Apple and Mozilla moved to distrust eight of its certificates in their browsers.

The company said its digital signature certificates, eSign and other signing services, including those in India, would continue. Its enterprise public key infrastructure products, emCA and CertiNext, the emSigner suite, and identity and authentication products SecurePass and emAS will also remain operational.

V. Srinivasan, chairman of eMudhra, said the company revoked the affected certificate authorities (CAs) within 14 hours of discovering the issue. He said no end-entity certificates had been issued by them, its infrastructure had not been breached and no data had been lost.

Srinivasan said SSL/TLS contributed about 1% of the company’s global revenue. He cited rising data sovereignty and compliance requirements, as well as the availability of free SSL/TLS certificates, as factors behind the decision to exit the business.

The company also said the attention the incident received on social media was disproportionate to the size of the business.

eMudhra described the incident as a “one-off error” and a “process lapse” that occurred on a specific day. It said corrective measures had been taken, that the wider ecosystem had not suffered damage and that browsers had implemented remedial measures.

eMudhra said its G1 RSA root certificates would continue serving customers until the transition was complete.

The company will contact affected customers and arrange replacement certificates through partners at no cost.

Source link