eMudhra Exit Certificate Business After Security Flaw
The move
Bengaluru-based cybersecurity company eMudhra plans to voluntarily wind down its global secure sockets layer and transport layer security, or SSL/TLS, certificate business. The decision follows a security incident involving weak private keys across eight intermediate certificate authority certificates, which prompted Google and Mozilla browser root programmes to distrust eMudhra’s certificates.
eMudhra said it revoked the affected certificate authorities within 14 hours of discovering the incident. It also said no end-entity certificates had been issued by the affected authorities, its infrastructure remained uncompromised and no data was breached.
Company focus
eMudhra said it would focus on its core enterprise business and more complex customer problems in areas such as AI and quantum computing.
Newsletter
The corridor, every morning.
Funding rounds and cross-border capital moves, one email, five minutes.
Customers
Existing customers will be transitioned to alternative providers free of charge over the next three to four weeks, with eMudhra working with other certificate partners to avoid service disruptions.
The company said the certificate segment accounts for around 1% of its global revenue. It also cited rising compliance costs, declining returns, free certificates from Let’s Encrypt, Cloudflare’s plan to offer the same, and browser guidelines moving towards 90-day certificates.
Company view
“The impact has been quite severe over the last 24-48 hours. Given the risk to the rest of the business and our obligations as a publicly listed company, the board felt it was prudent to withdraw from this business,” cofounder Kaushik Srinivasan told Inc42.
More in Market Move
