Increasing operational costs and heightened regulatory scrutiny prompt eMudhra to withdraw from the global SSL certificate market.
Dubai: Digital security firm eMudhra Limited has announced its decision to withdraw from the global website security certificate market following a security incident involving eight intermediate digital certificates. The company has assured stakeholders that its primary business operations remain unaffected.
The company’s board approved a voluntary exit from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business, pointing to increasing regulatory compliance expenses, operational challenges and weakening commercial viability.
The decision comes after a security researcher identified vulnerable private keys on October 17. Following the discovery, Google and Mozilla blocked the affected certificates, according to eMudhra.
eMudhra Confirms Core Business Remains Unaffected
The company stated that its global SSL/TLS certificate operations contribute approximately 1 per cent of its total worldwide revenue, indicating that the segment represents a relatively small portion of its business.
V Srinivasan, chairman of eMudhra, said the company acted promptly after identifying the security issue, revoking the affected certificate authorities within 14 hours of its discovery.
eMudhra stated that the affected certificate authorities had not issued any end-entity certificates and maintained that its systems had not been compromised. The company also confirmed that no data breach had occurred and that its physical and logical security measures remained secure.
These assurances reflect the company’s account of the incident. Its decision to withdraw from the market follows concerns surrounding the affected certificates and subsequent action by major browser providers.
Google and Mozilla Take Action Against Affected Certificates
SSL/TLS certificates play an important role in verifying website identities and securing encrypted communication between web browsers and servers. Browser companies operate trust programmes that determine which certificate authorities are recognised by their platforms.
The October security incident involved eight intermediate certificates associated with eMudhra’s global public key infrastructure (PKI). Following the disclosure, Google and Mozilla took action against the affected certificates, creating uncertainty over their continued acceptance by browsers.
eMudhra said the attention generated on social media had resulted in a level of scrutiny it considered excessive relative to the SSL/TLS segment’s limited contribution to its overall business.
Increasing Compliance Costs Prompt Market Exit
V Srinivasan, chairman of eMudhra, explained that growing data sovereignty requirements, regulatory responsibilities and operational expenses have made the international SSL/TLS certificate market increasingly difficult to manage.
He also highlighted intensifying competition from companies providing website security certificates at no cost, which has further reduced the business segment’s financial appeal.
Following an assessment of these challenges, eMudhra’s board determined that exiting the global SSL/TLS certificate market would best serve the interests of the company and its shareholders.
Customer Support and Certificate Replacement Plans
eMudhra confirmed that its G1 RSA root certificates will continue supporting customers throughout the transition period.
The company plans to work closely with browser trust programmes and affected customers to arrange free replacement certificates through its partners.
It also assured customers that certificate revocation and status-checking services would remain available until all previously issued certificates either expire or are replaced.
Additionally, eMudhra intends to meet its outstanding obligations to browser root programmes, including providing a detailed root-cause analysis report concerning the security incident.
Digital Signature and Enterprise Solutions to Remain Operational
eMudhra emphasised that its withdrawal from the global SSL/TLS certificate business will not disrupt its other services, including digital signature certificates (DSC), eSign, enterprise PKI, electronic signatures and identity authentication solutions.
The company confirmed that these operations, including its India-based businesses, will continue without interruption.
Going forward, eMudhra intends to concentrate on its established enterprise security solutions and broader digital trust services while completing its withdrawal from the international SSL/TLS certificate market.
With inputs from agencies.
