On Thursday, eMudhra Limited announced that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business following a recent security incident. Chairman V. Srinivasan said the company handled the incident diligently, revoking the affected certificate authorities (CAs) within 14 hours of discovering the issue and disclosing it promptly. He added that no end‑entity certificates were issued from the affected CAs, the infrastructure was not compromised, and no data was breached, with all physical and logical security controls remaining intact.

Srinivasan explained that the global SSL/TLS certificate business contributes around 1% of eMudhra’s revenue. Rising data sovereignty and compliance requirements have increased the complexity and cost of operating the business over the years, while competition from large entities offering SSL/TLS certificates free of charge has reduced its business potential and return on investment (RoI). The level of social media amplification around the incident has brought scrutiny that is out of proportion to SSL/TLS’s place in the company’s business.

Earlier this week, eMudhra disclosed a security incident involving the compromise of private keys associated with its certificates, as reported by the Indian Computer Emergency Response Team (CERT‑In). The incident involved private keys linked to eight intermediate CA certificates in eMudhra’s public key infrastructure (PKI), comprising six TLS certificates and two code‑signing certificates. The compromised keys could potentially be exploited by cybercriminals to create fraudulent digital identities or impersonate legitimate websites and services.

eMudhra said the incident affected a small part of its global TLS business and had no connection with its Indian Digital Signature Certificate (DSC) or eSign businesses. Government sources indicated that the impact on its Indian operations was expected to be limited. The company is working directly with potentially affected customers to provide replacement certificates and prevent disruption to critical services, and is also working with root programs and continuing its root‑cause investigation.

In its explanation, eMudhra said a flaw in its system had led to the creation of weak keys alongside the original strong keys. A security researcher had alerted Apple, Google, Microsoft and Mozilla that the weak keys could potentially be reverse‑engineered, possibly with the assistance of artificial intelligence (AI). The company will reach out to affected customers to replace any certificate free of cost from partners through the transition, and revocation and certificate status services will keep running until every issued certificate has expired or been replaced.

Shares of eMudhra tumbled 20% on Thursday following news of the security incident, putting the stock in focus as investors assess the potential reputational and business implications of the episode and the company’s decision to exit the global SSL/TLS certificate business. eMudhra’s core digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) remain unaffected and continue to operate as normal.