eMudhra to exit global SSL/TLS biz as shares; 30,000 certificates affected

Bengaluru: Shares of digital trust company eMudhra plunged 20% on BSE for the second consecutive day on Thursday after the company announced its decision to voluntarily exit the global SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate business following a security incident involving eight of its intermediate certificate authorities.The company’s board decided to withdraw from the business after reviewing its commercial prospects and the scrutiny triggered by the incident. The global SSL/TLS business contributes about 1% of eMudhra’s revenue, but rising compliance requirements, increasing costs and competition from free certificate providers have reduced its potential returns, the company said.“The scrutiny was disproportionate to the revenue contribution of the business,” Kaushik Srinivasan, co-founder of eMudhra, told TOI, explaining the board’s decision. He said the board met on Thursday to assess the business’s future following the incident and the sharp fall in the company’s share price over the past two sessions.Investors were bearish on the eMudhra stock after the cyber incident. In two sessions since the incident, its stock price has crashed 36% to Rs 345 by Thursday’s close, from Rs 539 at Monday’s close.The issue was reported on Oct 17 by Dennis Jackson, a member of Mozilla’s cryptography engineering team, who flagged weaknesses in the keys associated with the eight eMudhra intermediate certificates.Srinivasan said the economics of the business were becoming less attractive as certificate validity periods shortened. “The return on investment, considering the effort, investment and compliance requirements, is becoming less attractive. It makes more sense to strengthen and invest in our enterprise solutions business, which has higher margins and greater potential,” he said.The incident stems from a key-generation process conducted on April 30, 2025. Srinivasan said delays in procuring hardware for North American operations meant the company had to generate keys in India and subsequently export them. A script error resulted in weak keys, while inadequate maker-checker controls contributed to the problem.“It was a script error and human error,” he said, adding that the company would strengthen operational and security controls and review its processes.The company said it revoked the affected intermediate certificate authorities within 14 hours of discovering the issue and disclosed it promptly. Chairman V Srinivasan said the incident did not involve a compromise of the company’s infrastructure or a data breach, and that physical and logical security controls remained intact.The incident has also affected customers relying on eMudhra’s G3 root, a top-level certificate authority that helps browsers establish trust in digital certificates used to authenticate websites and secure connections.Kaushik Srinivasan said around 30,000 certificates associated with the G3 root were affected after it was distrusted, and the company was working to transition them. One customer in North America was impacted, he said.The company is working with browser programmes and customers to manage the transition. It plans to replace affected certificates and use alternative providers where required, while seeking to minimise disruption to customer-facing services.“Our G1 root, as I understand it, continues to be trusted,” Srinivasan said, adding that the company was also working to transition customers covered by the G1 root. The company has said its G1 RSA roots will continue to serve customers until the transition is complete and that replacement certificates will be provided free of cost through partners.Srinivasan said the company would commission an independent review by an empanelled auditor to examine its cryptographic keys, key inventories and key-generation processes. The findings will be made public, he said.eMudhra plans to focus on its other businesses, including digital signature certificates, eSign, enterprise public key infrastructure platforms, its emSigner eSignature Suite, and identity and authentication solutions. The company said these operations run on infrastructure separate from its global SSL/TLS business and remain unaffected.While the direct revenue contribution from SSL/TLS is small, Srinivasan said the company was also seeking to contain the reputational risk arising from the incident and restore customer confidence.The Indian Computer Emergency Response Team (CERT-In), in an advisory issued on Wednesday, said eight eMudhra intermediate certificate authorities were affected by a key-generation flaw that resulted in weak cryptographic private keys.You use AI every day. Now get your AI Quotient. Take the AIQ test.