eMudhra to exit SSL and TSL certification business

Digital authentication services company eMudhra that provides digital identity and digital signature services on Thursday said it has decided to exit from the SSL and TSL certification business The move comes was after the discovery of a vulnerability in the security keys issued by certification authorities under itSecure Sockets Layer SSL and Transport Layer Security TLS certificates are global security standards that authenticates whether websites starting with https are safe to browse When a user visits a website using HTTPS the browser checks its digital certificate to establish whether the website can be trusted and to help secure the connectionHowever eight digital certificates issued by the company were found to have weak cryptographic private keys that could reportedly be recovered almost instantly Cybercriminals could have used the compromised keys to build a fraudulent online platform impersonating a legitimate payment entity and lure people into making payments or exposing their personal information according to PTISSL and TLS certificate business exiteMudhra Limited a global digital trust company today announced that its Board has decided to voluntarily withdraw from the global SSLTLS certificate business the company said in a statementV Srinivasan Chairman eMudhra referred to the recent incident relating to its global SSLTLS certificate and indicated that eMudhra handled the recent incident diligently revoking the affected CAs Certification Authority within 14 hours of discovery and disclosing promptly There were no end entity certificates issued out of the affected CAs Its infrastructure was not compromised no data was breached All physical and logical security controls remained intact the statement saidHe added that global SSLTLS is a small part of eMudhras business contributing to about 1 per cent of the global revenueDue to increasing data sovereignty and compliance requirements complexity and cost associated with this business is increasing over the years This paired with the fact that some of the large entities issue the SSLTLS free of cost the business potential and RoI return on investment of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base the statement saidCompany to focus on Core Enterprise SolutionsThe company said the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSLTLSs place in its businessIn view of this after detailed deliberations our board has concluded that withdrawing from global SSLTLS is the right decision for eMudhra and its shareholders For many certifying authorities SSLTLS is the whole business For eMudhra it is one part of a much broader digital solutions portfolio We will put our energy where we create the most value for customers with sharpened focus on Core Enterprise Solutions and trust services other than SSLTLS the statement saidThe company said its global SSLTLS infrastructure runs separately from its other operations Its global digital signature certificate DSC eSign and other signing services including those in India its enterprise PKI Solutions emCA CertiNext platforms emSigner eSignature Suite and its identity and authentication solutions SecurePass emAS are not affected and continue to operate as normalMeitY to investigate the incidentA cyber security researcher had reported about the vulnerability to Apple Google Microsoft and Mozilla that certain weak keys issued by eMudhras certification authorities could be reverseengineered possibly with AIassisted techniques according to PTIThe Ministry of Electronics and Information Technology MeitY has constituted a special team to investigate the incident at eMudhraThe shares of the company had tanked 20 per cent to hit the lower circuit at Rs 34525 on BSE on ThursdayWith inputs from PTI