Digital authentication company eMudhra has announced its decision to withdraw from the global Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate business following the discovery of vulnerabilities in cryptographic keys issued by its certification authorities.
After hitting lower circuit on Thursday, the stock of the company further declined over 3% on Friday.
In a statement, eMudhra said its board had approved the voluntary withdrawal as part of a broader strategic review.
Security Vulnerability Prompts Investigation
SSL/TLS certificates help authenticate websites and establish encrypted connections between browsers and online services.
The security issue involved eight eMudhra issuing certification authorities (CAs) whose cryptographic keys were weaker than required.
Such vulnerabilities could potentially allow attackers to impersonate legitimate websites and expose users to fraudulent transactions or information theft.
A cybersecurity researcher alerted Apple, Google, Microsoft and Mozilla that the affected keys might be reconstructed using artificial intelligence-assisted techniques.
Following the disclosure, the Ministry of Electronics and Information Technology (MeitY) constituted a special team to investigate the incident.
eMudhra Chairman V Srinivasan said the company revoked the affected certification authorities within 14 hours of discovering the problem.
The company maintained that no end-entity certificates had been issued through the affected authorities.
It also stated that its infrastructure remained secure, with no data breach or compromise of physical and logical security controls.
eMudhra To Focus On Enterprise Solutions
According to the company, its international SSL/TLS operations contribute approximately 1% of global revenue.
eMudhra cited increasing regulatory compliance requirements, data sovereignty obligations and operating costs as reasons for exiting the segment.
The availability of free SSL/TLS certificates from larger providers has also reduced the business's commercial attractiveness and return on investment.
The company said the affected segment represented only a small portion of its wider digital solutions portfolio.
Going forward, eMudhra intends to concentrate resources on enterprise technology solutions and digital trust services outside the global SSL/TLS certificate business.
