eMudhra Exits TLS Market After Flawed Certificate Scandal
Indian certificate authority eMudhra is withdrawing from the global TLS market after researchers discovered eight intermediate certificates with critically weak private keys. The flaw allowed attackers to mint trusted certificates for any website in milliseconds. Citing low revenue contribution and high compliance costs, eMudhra’s board decided to exit the business, a move that impacts global web security infrastructure reliant on its previously trusted credentials.
Key points
- eMudhra, an Indian certificate authority, announced its exit from the global TLS market after researchers identified eight intermediate certificates with defective private keys.
- The flaw allowed attackers to generate trusted TLS certificates for any website or mail server in milliseconds, affecting browsers, IoT devices, and email servers.
- V. Srinivasan, chairman of eMudhra Limited, cited rising compliance costs and the certificate business generating only 1% of total revenue as primary reasons for the withdrawal.
- The decision follows the emergence of free TLS providers, which reduced returns on investment compared to eMudhra’s other services and intensified social media scrutiny.
- The board concluded that withdrawing from global SSL/TLS is the right decision for shareholders, aiming to mitigate disproportionate scrutiny relative to the product's revenue share.
eMudhra, an India-based certificate authority, has decided to exit the global TLS market following a significant security scandal. Researchers recently revealed that the company had issued eight intermediate certificates with private keys so weak that they could be trivially discovered. This defect allowed anyone to mint trusted TLS certificates for any website or mail server in milliseconds, potentially impacting major browsers, email servers, and various IoT devices that rely on eMudhra’s credentials.
V. Srinivasan, chairman of eMudhra Limited, stated that the decision stems from increasing compliance costs and complexities. The TLS business generated only 1% of the company’s total revenue, making it less attractive compared to other services. Additionally, the rise of organizations offering free TLS certificates further reduced the return on investment. The company noted that social media amplification brought scrutiny out of proportion to SSL/TLS’s actual place in its business model.
In a recent announcement, eMudhra’s board concluded that withdrawing from global SSL/TLS is the right decision for its shareholders. This move aims to streamline operations and focus on more profitable services. However, the exit may force many organizations to migrate to other certificate authorities, potentially impacting global web security infrastructure in the near term.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
