eMudhra to Shut Down Global SSL/TLS Certificate Business After Major Security Breach

Bengaluru-based cybersecurity company eMudhra has announced that it will shut down its global digital certificate business following a security incident involving the exposure of private cryptographic keys linked to eight intermediate certificates. The incident prompted major browser companies, including Google, Apple, Microsoft and Mozilla, to block the affected certificates amid concerns about potential risks to internet security. The company cited rising compliance requirements, data sovereignty concerns, operational complexity and increasing costs as reasons for its decision. It also said the global SSL/TLS certificate business contributes only around one per cent of its revenue.

The company stated that it revoked the affected certificates within 14 hours of discovering the issue and maintained that its infrastructure had not been compromised and no data had been breached. Although there is no clear evidence that the exposed keys were used maliciously, cybersecurity experts warned that they could potentially have enabled the creation of fraudulent website certificates. eMudhra said it would continue working with browser companies, publish a root-cause report after its investigation and replace affected certificates free of cost during the transition period. The company added that its Indian digital signature, eSign and other signing services remain unaffected and will continue operating normally.