eMudhra to exit website security certification business after security weakness, company says no data breach—All we know
Digital authentication services company eMudhra, which grabbed headlines after Apple, Google, Microsoft and Mozilla blocked its digital certificates due to weak private keys, said it will exit the website security certification business, PTI reported.
eMudhra has decided to exit from the SSL and TSL certification business after a vulnerability was discovered in the security keys issued by certification authorities under it, the company said on Thursday.
The company's shares tanked 20% to hit the lower circuit at ₹345.25 on BSE following the announcement.
Quick answers to key questions
•5 QUESTIONS
1
Why is eMudhra exiting the global SSL/TLS certificate business?⌵eMudhra said it is voluntarily withdrawing after vulnerabilities were found in keys associated with eight issuing certificate authorities. It also cited rising compliance requirements, increasing complexity and costs, and reduced business potential.
2
What was the security weakness in eMudhra's SSL/TLS certificates?⌵Eight issuing certificate authorities were created with weaker-than-intended cryptographic keys. A researcher warned that the keys could potentially be reverse-engineered and used to impersonate legitimate websites.
3
Did the eMudhra certificate incident result in a data breach?⌵eMudhra said its infrastructure was not compromised and no data was breached. The company also said it revoked the affected certificate authorities; the reports describe the risk of misuse but no clearly disclosed direct breach resulting from the incident.
4
Are eMudhra's Indian digital signature and eSign services affected?⌵The company said the incident concerns its global SSL/TLS certificate business, which runs on separate infrastructure. It stated that its Indian digital signature certificate and eSign services remain unaffected and are operating normally.
5
How can users reduce security risks related to the eMudhra certificate issue?⌵The advice reported was to update internet browsers, phones and laptops, install the latest versions of banking and trading apps, and check for security updates for routers and smart devices.
eMudhra issues digital signature and website security certificates that enable secure connections to browsers for public access. SSL and TLS certificates are global security standards that indicate websites using them are safe to browse. Such websites display web addresses starting with “https”.
“eMudhra Limited, a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business,” the company said in a statement.
eMudhra Chairman V Srinivasan referred to the recent incident involving its global SSL/TLS certificate and said eMudhra handled it diligently, revoking the affected CAs within 14 hours of discovery and disclosing it promptly.
"There were no end entity certificates issued out of the affected CA's. Its infrastructure was not compromised, no data was breached. All physical and logical security controls remained intact," the statement said.
He added that global SSL/TLS is a small part of eMudhra's business, contributing to about 1% of the global revenue. “Due to increasing data sovereignty and compliance requirements, complexity and cost associated with this business are increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI (return on investment) of this line of business has also been considerably reduced for eMudhra when measured against our cumulative revenue base,” the statement said.
Eight of eMudhra's issuing CAs were created with weaker keys than they should have been.
Cybercriminals could have used the compromised keys to build a fraudulent online platform impersonating a legitimate payment entity and lure people into making payments or exposing their personal information.
A cyber security researcher had reported about the vulnerability to Apple, Google, Microsoft and Mozilla that certain weak keys issued by eMudhra's certification authorities could be reverse-engineered possibly with AI-assisted techniques.
Taking cognisance of the matter, the Ministry of Electronics and IT (MeitY) has constituted a special team to investigate a security incident at eMudhra.
eMudhra said the SSL/TLS business is part of a much broader digital solutions portfolio. “We will put our energy where we create the most value for customers with sharpened focus on core enterprise solutions and trust services other than SSL/TLS,” the statement said.
(With inputs from PTI)
For about a decade, Livemint—News Desk has been a credible source for authentic and timely news, and well-researched analysis on national news, business, personal finance, corporates, politics and geopolitics. We bring the latest updates on all the listed companies on BSE and NSE, startups, mutual funds, Union ministries, geopolitics, and untapped human interest stories from around the world, helping our readers to stay informed on the latest developments around the globe. Our Coverage Areas 1. Companies: Comprehensive news and analysis on listed and unlisted companies, corporate announcements, corporate chatter, C-suite, business trends, hiring alerts, layoffs, work-life balance, world's top billionaires and richest and more. 2. Personal finance: Insights into mutual funds, small savings schemes like - PPF, SSY, post office savings scheme, stock to watch, personal loans, credit cards, top bank FDs, real estate, income tax and more. 3. Politics: Comprehensive coverage of general elections, state elections and bypolls, Lok Sabha, Vidhan Sabha, Parliament, PMO, PIB, finance ministry, home ministry, among other union ministries and government departments. 4. National News: From metro cities like Delhi, Mumbai, and e to untapped stories from rural India, we cover human interest, health, education, crime and courts, and law and order, among other areas of public interest. 5. Economy: In-depth analysis of India's macro and micro-economic indicators like- GDP, inflation, forex, fiscal deficit, current account deficit, interest rate cycle, economic recovery, RBI circulars, indirect taxes, GST, Insolvency and Bankruptcy imports, exports and everything that impacts Indian economy. 6. Geopolitics: Well-rounded and deeply researched coverage on US News, Oval Office European Union, Ukraine Russia War, middle-east crisis, royal families and global leaders like - Donald Trump, Vladimir Putin, Kim Jong Un, Xi Jinping and premiers of other leading economies in the world. Meet the Team 1. Gulam Jeelani, Political Affairs Editor 2. Sugam Singhal, Senior Assistant Editor 3. Chanchal, Assistant Editor 4. Sanchari Ghosh, Chief Content Producer 5. Pratik Prashant Mukane, Chief Content Producer 6. Sayantani Biswas, Chief Content Producer 7. Ravi Hari, Deputy Chief Content Producer 8. Garvit Bhirani, Deputy Chief Content Producer 9. Akriti Anand, Senior Content Producer 10. Jocelyn Felix Fernandes, Senior Content Producer 11. Swastika Das Sharma, Content Producer 12. Mausam Jha, Content Producer 13. Riya R Alex, Trainee Content Producer
Catch all the Business News , Corporate news , Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
More
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.