Key Takeaways:
- The eMudhra security flaw prompted its exit from the global website certificate business.
- Major browser companies blocked the affected certificates after independent researchers reported the flaws.
- The business accounts for about 1% of eMudhra’s total revenue.
Indian digital authentication company eMudhra announced on Thursday that it will exit the global website security certificate business following an eMudhra security flaw involving weak cryptographic keys.
eMudhra withdraws from global certificate business
eMudhra confirmed that it plans to shut down its operations in the global website certificate market. The company said the eMudhra security flaw involved eight intermediate security keys generated by its systems.
Independent security researchers found that the flawed keys could be cracked within seconds. After the discovery, major technology companies, including Google, Apple, Microsoft, and Mozilla, stopped trusting the affected certificates to help protect internet users.
eMudhra said its internal systems remained secure and that no customer data was compromised. The company also stated that no certificates for end users had been issued using the vulnerable keys.
Company cites compliance costs and small revenue share
eMudhra said running its website certificate business had become more expensive because of rising compliance costs and complex regulations. The company added that the global website security division contributes only about 1% of its total revenue.
The company said public attention on social media accelerated its decision to leave the market. It plans to shift resources toward its main business services for companies and digital signature services in India.
eMudhra said it will continue checking the validity of existing customers’ certificates until all currently active certificates expire. Its technical teams will also submit a full investigation report to browser authority programs.
eMudhra shares fall 20% after security issue
The eMudhra security flaw and the company’s planned exit from the global certificate business affected investor sentiment. eMudhra shares fell 20% on Thursday, reaching the lower circuit limit on the BSE, which restricts further price declines during a trading session.
Government officials and cybersecurity groups have started examining how and when the weak keys were generated. The Ministry of Electronics and Information Technology has formed a team to review the incident.
The eMudhra security flaw has also highlighted the importance of stronger cryptographic security checks among digital certificate providers.
Industry observers expect other digital certificate providers to review and strengthen their security checks following the incident. eMudhra said its other business operations continue to run normally.
