eMudhra Limited, a global digital trust company based in India, has announced its decision to voluntarily withdraw from the global SSL/TLS certificate business. The move follows a recent security incident involving its global SSL/TLS certificates. According to the company, the incident was handled by revoking the affected Certificate Authorities (CAs) within 14 hours of discovery. eMudhra stated that its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact. The company noted that no end-entity certificates were issued from the affected CAs.
This image relates to the security incident involving the company's global SSL/TLS certificates and the subsequent revocation of affected CAs.
The decision to exit the SSL/TLS market is driven by a combination of economic and regulatory factors. eMudhra reported that the global SSL/TLS business contributes only about 1% of its total global revenue. The company cited increasing data sovereignty and compliance requirements as factors that have significantly increased the complexity and cost of maintaining this specific business line. Furthermore, because many large entities issue SSL/TLS certificates for free, eMudhra indicated that the return on investment for this segment has diminished relative to its broader revenue base. The company also acknowledged that the social media attention surrounding the recent incident was disproportionate to the SSL/TLS segment's role in its overall operations.
While eMudhra is exiting the global SSL/TLS market, it intends to maintain its other core operations, which run on separate infrastructure. These include its Global digital signature certificate (DSC) and eSign services, enterprise PKI solutions (such as the emCA and CertiNext platforms), and identity and authentication solutions like SecurePass and emAS. To ensure a seamless transition for existing customers, eMudhra's G1 RSA roots will continue to serve users until the transition is complete. The company plans to work with browser programs and customers to facilitate this move, offering free certificate replacements from partners to affected users. eMudhra also committed to providing a full root-cause report to browser root programs as part of its remaining obligations.
The article mentions SecurePass as one of the core identity and authentication solutions that will remain active despite the exit from the SSL/TLS market.