Source : INDIA TODAY NEWS
eMudhra has decided to exit the global SSL/TLS certificate business following a recent security incident that drew scrutiny on social media. The digital trust company said on October 22 that its board had approved the voluntary withdrawal, citing the growing complexity and cost of running the business, declining returns and the disproportionate attention generated by the incident.
The company said the SSL/TLS business contributes around 1 per cent of its global revenue. It plans to focus instead on its enterprise solutions and other digital trust services, which remain unaffected by the incident.
advertisement
The announcement comes after concerns emerged over eMudhra’s global SSL/TLS certificate infrastructure. The company said it handled the incident by revoking the affected certificate authorities (CAs) within 14 hours of discovering the issue and disclosing it promptly. According to eMudhra, no end-entity certificates had been issued by the affected CAs, its infrastructure was not compromised, and no data was breached. It also said all physical and logical security controls remained intact.
Why eMudhra is exiting the business
In its statement, eMudhra Chairman V Srinivasan said the growing attention on social media had brought scrutiny that was out of proportion to the business’s contribution to the company. He said the board concluded that exiting the segment was the right decision for the company and its shareholders.
The company also pointed to rising compliance requirements, data sovereignty rules and the increasing complexity and cost of operating a global SSL/TLS certificate business. At the same time, some large providers offer these certificates for free, putting pressure on the business’s potential returns.
SSL/TLS certificates help establish secure connections between websites and users. They enable HTTPS connections, encrypting information exchanged between a browser and a website. Certificate authorities issue these certificates after validating the relevant information. Browsers rely on trusted certificate authorities to determine whether a website’s certificate can be trusted.
For eMudhra, however, this business represents only a small part of its overall operations. The company said it would direct more resources towards its core enterprise solutions and digital trust services beyond SSL/TLS certificates.
What happens to existing customers?
eMudhra said the withdrawal would involve a transition rather than an immediate shutdown of all certificate-related services. Its G1 RSA root certificates will continue serving customers until the transition is completed, as the company works with browser programmes and customers on the process.
The company will contact affected customers and arrange for their certificates to be replaced free of cost through its partners. Revocation and certificate-status services will also continue until every issued certificate has expired or been replaced.
eMudhra said it would fulfil its remaining commitments to browser root programmes, including submitting a complete root-cause report on the incident.
Other eMudhra services will continue
The company clarified that its global SSL/TLS infrastructure operates separately from its other businesses. Its digital signature certificates (DSC), eSign and other signing services, including those in India, will continue operating normally.
Its enterprise public key infrastructure (PKI) platforms, emSigner eSignature Suite and identity and authentication products, including SecurePass and emAS, are also unaffected.
The exit, therefore, is limited to the global SSL/TLS certificate business and does not amount to a withdrawal from eMudhra’s wider digital trust operations.
– Ends
SOURCE :- TIMES OF INDIA
