Indian digital trust services provider eMudhra will shut down its global digital certificate business following a security lapse that prompted major web browsers to block compromised certificates, raising concerns about internet security.
Announced on October 22, the decision follows the discovery of weak cryptographic private keys linked to eight intermediate certificates used to authenticate websites. The incident was first reported by an independent security researcher known as Wayne, who uncovered the keys through reverse engineering, potentially using AI-assisted techniques.
Companies including Google, Apple, Microsoft and Mozilla moved to block the affected certificates to prevent potential misuse. Although there is no confirmed evidence that malicious actors exploited the compromised keys to intercept encrypted web traffic, experts warned that the vulnerability could have allowed attackers to issue fraudulent website certificates and impersonate legitimate websites.
eMudhra attributed its exit to increasing regulatory compliance requirements, data sovereignty concerns, operational complexity and rising costs. The company also cited reputational damage following widespread attention to the incident. With several providers offering SSL/TLS certificates free of charge, the business had become less profitable and contributed approximately one per cent of its global revenue.
The company said it revoked the affected certificate authorities within 14 hours of discovering the issue. Chairman V Srinivasan stated that its infrastructure had not been compromised, no data breach had occurred, and no end-entity certificates had been issued through the affected authorities.
The company has stopped issuing certificates under the affected G3 chain and will publish a root-cause report after completing its investigation. Existing certificates issued under its RSA root will continue to function during a transition period. eMudhra has also committed to replacing affected certificates free of cost through its partners and maintaining certificate status services until all relevant certificates expire or are replaced.
However, its Indian operations will continue as normal. These include government-authorised certification services, digital document signing, enterprise public-key infrastructure and identity authentication solutions. The company serves Indian government entities, including UIDAI and the Income Tax Department.
Following the disclosure, eMudhra’s listed shares fell approximately 40 per cent over two days, reflecting market concerns about the incident’s potential business impact.
Source: The Indian Express
