eMudhra to exit website security certification business after security weakness, company says no data breach -- All we know

Digital authentication services company eMudhra, which grabbed headlines following impact on and Apple, Google and Microsoft websites, has said it will exit the website aecurity certification business, PTI reported.

eMudhra has decided to exit from the SSL and TSL certification business after a vulnerability was discovered in the security keys issued by certification authorities under it, the company said on Thursday.

The company's shares tanked 20% to hit the lower circuit at ₹345.25 on BSE following the announcement.

Quick answers to key questions

eMudhra said it is voluntarily withdrawing after vulnerabilities were found in keys associated with eight issuing certificate authorities. It also cited rising compliance requirements, increasing complexity and costs, and reduced business potential.

Eight issuing certificate authorities were created with weaker-than-intended cryptographic keys. A researcher warned that the keys could potentially be reverse-engineered and used to impersonate legitimate websites.

eMudhra said its infrastructure was not compromised and no data was breached. The company also said it revoked the affected certificate authorities; the reports describe the risk of misuse but no clearly disclosed direct breach resulting from the incident.

The company said the incident concerns its global SSL/TLS certificate business, which runs on separate infrastructure. It stated that its Indian digital signature certificate and eSign services remain unaffected and are operating normally.

The advice reported was to update internet browsers, phones and laptops, install the latest versions of banking and trading apps, and check for security updates for routers and smart devices.

SSL and TLS certificates are global security standards that indicate websites using them are safe to browse. Such websites display web addresses starting with "https".

"eMudhra Limited, a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business," the company said in a statement.

eMudhra issues digital signature and website security certificates that enable secure connections to browsers for public access.

Eight of eMudhra's issuing CAs were created with weaker keys than they should have been.

Cybercriminals could have used the compromised keys to build a fraudulent online platform impersonating a legitimate payment entity and lure people into making payments or exposing their personal information.

A cyber security researcher had reported about the vulnerability to Apple, Google, Microsoft and Mozilla that certain weak keys issued by eMudhra's certification authorities could be reverse-engineered possibly with AI-assisted techniques.

eMudhra Chairman V Srinivasan referred to the recent incident involving its global SSL/TLS certificate and said eMudhra handled it diligently, revoking the affected CAs within 14 hours of discovery and disclosing it promptly.

"There were no end entity certificates issued out of the affected CA's. Its infrastructure was not compromised, no data was breached. All physical and logical security controls remained intact," the statement said.

He added that global SSL/TLS is a small part of eMudhra's business, contributing to about 1 per cent of the global revenue.

"Due to increasing data sovereignty and compliance requirements, complexity and cost associated with this business are increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI (return on investment) of this line of business has also been considerably reduced for eMudhra when measured against our cumulative revenue base," the statement said.

eMudhra said the SSL/TLS business is part of a much broader digital solutions portfolio.

"We will put our energy where we create the most value for customers with sharpened focus on core enterprise solutions and trust services other than SSL/TLS," the statement said.