Bengaluru-based digital trust company eMudhra has decided to exit its global SSL/TLS certificate business following a security incident involving weak cryptographic keys that prompted action from Google and Mozilla. In a regulatory filing on Thursday, the company said its board had decided to voluntarily withdraw from the business, citing rising compliance costs, increasing data sovereignty requirements and diminishing commercial returns. The decision follows the discovery of eight intermediate certificate authority keys linked to eMudhra that were found to be dangerously weak, potentially allowing attackers to impersonate legitimate websites. The keys were generated in April 2025, but the weakness remained undetected for about 18 months. Google and Mozilla subsequently moved to block the affected certificates to protect users. eMudhra Chairman V Srinivasan said the company had revoked the affected certificate authorities within 14 hours of discovering the incident and promptly disclosed the issue.

The company maintained that its infrastructure had not been compromised, no data had been breached and none of the affected intermediate authorities had issued end-user certificates.

Global SSL/TLS certificates, which help authenticate websites and secure online communications, contribute approximately 1% of eMudhra's global revenue.

Srinivasan said increasing data sovereignty and compliance requirements had made the business more complex and expensive to operate. Competition from large providers offering SSL/TLS certificates free of cost had also reduced its commercial potential and return on investment.

"The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business," Srinivasan said.

He added that the board, following detailed deliberations, had concluded that withdrawing from the global SSL/TLS business was the right decision for the company and its shareholders.

Source link