Key Takeaways
- eMudhra, a certificate authority, has withdrawn from the global SSL/TLS business.
- The company cited increasing costs and reduced returns as reasons for the decision.
- Social media scrutiny over weak TLS credentials issued by eMudhra intensified the decision.
eMudhra, an Indian certificate authority, has announced its exit from the global SSL/TLS business. The company, which issued eight intermediate TLS credentials that were so weak that anyone could mint certificates for any website or mail server, including one with a private encryption key of just 4, has decided to discontinue this service.
V. Srinivasan, chairman of eMudhra Limited, stated that the business only generated 1 percent of the company’s revenue and that the increasing costs and complexities of compliance requirements were significant factors in the decision. He also noted that the emergence of free TLS certificate providers further reduced the returns on investment compared to other services the company offers.
In a statement, eMudhra acknowledged the social media amplification around the incident, which it described as out of proportion to the business’s place in their overall operations. The company’s board concluded that withdrawing from global SSL/TLS is the right decision for both the company and its shareholders.
The incident involved eMudhra issuing TLS credentials that were so weak that they could be easily exploited. This raised significant concerns about the security and reliability of the certificates issued by the company. The social media backlash over these weak certificates intensified the decision to exit the business.
The company emphasized that the decision was made after detailed deliberations and that it was not solely based on the social media scrutiny. However, the amplified public attention did contribute to the final decision. Srinivasan stated, 'However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.'
eMudhra’s exit from the TLS business marks a significant shift in the market, where free and more secure certificate providers are becoming more prevalent. This move could have implications for businesses and individuals relying on TLS for secure communications and transactions.
The decision to exit the TLS business is part of a broader trend in the industry, where companies are reevaluating the costs and benefits of providing such services. As the landscape continues to evolve, eMudhra’s exit could signal a shift towards more stringent security standards and a reduction in the number of certificate authorities in the market.
While eMudhra is no longer offering TLS services, the company will continue to operate in other areas, focusing on its core competencies and services. The decision to withdraw from the TLS business is expected to have minimal impact on the company’s overall operations and financial performance.
However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.
V. Srinivasan, Chairman of eMudhra Limited
