eMudhra exits TLS business after weak key incident

eMudra Limited, the India-based certificate authority, has decided to withdraw from its global SSL/TLS business following a security incident involving weak intermediate credentials. The company issued eight intermediate TLS certificates that were so poorly secured that anyone could mint certificates for any website or mail server. One of these certificates used a private encryption key with a value of just 4. V. Srinivasan, chairman of eMudra, attributed the decision to rising compliance costs and complexities. He noted that the TLS segment generated only 1 percent of the company's total revenue. Srinivasan also cited the emergence of organizations providing free TLS certificates, which reduced the return on investment compared to other eMudra products and services.

In a post published on Thursday, eMudra stated that social media amplification of the incident brought scrutiny out of proportion to the business's actual scale. The company's board concluded, after detailed deliberations, that exiting the global SSL/TLS market is the right decision for eMudhra and its shareholders. The announcement follows the revelation of the compromised keys, which allowed unauthorized issuance of digital identities.