eMudhra Announces Exit From Global Digital Certificate Business After Major Security Flaw Raises Internet Safety Concerns:

Bengaluru-based cybersecurity company eMudhra announced on Thursday, October 22, that it will shut down its global digital certificate business following a major security lapse that raised concerns about internet security worldwide. The incident involved the exposure of eight private cryptographic keys used to issue web security certificates, creating a potential risk for billions of internet users.

The company said the decision was driven by rising compliance requirements, data protection rules, operational complexity and the increasing cost of running its Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate business. eMudhra also said that the incident received widespread attention on social media, leading to scrutiny of its global operations that it believes was disproportionate to the issue.

SSL and TLS certificates help secure communication between websites and users by encrypting data. They also help web browsers verify that a website is genuine. For example, when users access their bank’s website, these certificates help confirm that they are connecting to the bank’s legitimate server rather than a fake website.

The company said its global SSL/TLS business contributes only around one per cent of its total global revenue. With several major providers offering similar certificates for free, the business has also become less profitable. However, the recent security incident has added to the pressure by damaging the company’s reputation.

Kaushik Srinivasan, co-founder of eMudhra, told The Indian Express that the company was working to rebuild trust by contacting customers and explaining the incident. He said such security issues could potentially affect other companies as well. Asked whether the incident could affect its relationship with Indian government clients, he said he did not expect a major impact, adding that government advisories had indicated there was no impact on the wider ecosystem. Meanwhile, eMudhra’s shares fell around 40 per cent over the two days following the disclosure of the vulnerability.

What happened in the security incident?

eMudhra operates as a Certificate Authority (CA), an organisation trusted by web browsers to issue digital certificates that verify the identity of websites. On Wednesday, October 21, the company confirmed that weak private cryptographic keys linked to eight intermediate certificates had been compromised.

The problem was first flagged by an independent security researcher, who uses the name Wayne and says he reverse-engineered the certificates to find the private keys, possibly with the help of AI tools. They could have been used to generate bogus security certificates for websites, allowing attackers to impersonate legitimate sites and putting users at risk.

Following the disclosure, major technology companies such as Apple, Google, Microsoft and Mozilla moved to block the intermediate certificates in question. Updates and security advisories also came from operating system vendors, internet infrastructure firms, application developers and cybersecurity teams in an effort to reduce the risk of abuse.

Although there is no clear evidence so far that attackers used the compromised keys to intercept or decrypt encrypted internet traffic, security experts warned that the incident could have had serious consequences. They noted that some of the keys were so weak that they could potentially be discovered and misused to create fraudulent certificates. One of the compromised keys was reportedly the number ‘4’.

eMudhra’s response and next steps

eMudhra chairman V Srinivasan said the company revoked the affected certificate authorities within 14 hours of discovering the issue and disclosed the incident promptly. He also said no end-user certificates had been issued by the affected certificate authorities, the company’s infrastructure had not been compromised, and there was no data breach. According to him, all physical and digital security controls remained intact.

The company said it would continue working with major browser providers and publish a detailed report explaining the root cause of the incident after its investigation is complete. It has already stopped issuing certificates under the G3 certificate chain, which included the compromised intermediate certificates.

Certificates issued under other chains, including the emSign Root CA – G1, will continue to serve customers during a transition period. eMudhra has also said it will replace affected certificates through its partners at no cost. The company will continue operating certificate status services, including Certificate Revocation Lists (CRLs), until all emSign SSL/TLS certificates have expired or been replaced.

eMudhra is among the certifying authorities licensed by the Controller of Certifying Authorities (CCA), under the Ministry of Electronics and Information Technology (MeitY), to issue digital certificates for government websites, including the Unique Identification Authority of India (UIDAI) and the income tax portal.

Apart from its global SSL/TLS certificate business, the company provides digital document signing, electronic signing services such as eSign, enterprise Public Key Infrastructure (PKI) solutions, and identity verification and authentication services.

The company has clarified that its global digital signature certificate business, eSign and other digital signing services, including those operating in India, have not been affected by the security incident and will continue to function normally.