Abstract:
Indian digital trust and network security company eMudhra announced on October 22 that the company’s board of directors has decided to voluntarily withdraw from the global SSL/TLS certificate business. In the future, the company will further focus on core enterprise solutions and digital trust services in addition to SSL/TLS.
V. Srinivasan, chairman of eMudhra, said that the company recently experienced an incident involving the global SSL/TLS certificate system. The company completed the revocation of the affected certificate authority (CA) within 14 hours after discovering the problem and promptly disclosed information. The company emphasized that the affected CA did not issue any end-entity certificates, the infrastructure was not compromised, and no data leakage occurred, and all physical and logical security controls remain intact and effective.
According to data disclosed by the company, the global SSL/TLS business only accounts for about 1% of its global revenue. eMudhra pointed out that as data sovereignty and compliance requirements continue to increase, the operational complexity and costs of the business continue to rise. At the same time, some large organizations have begun to provide SSL/TLS certificates for free, which has significantly reduced the market potential and return on investment in this business field.
The company believes that although the SSL/TLS business accounts for a relatively small proportion of the overall business, recent events have been widely spread on social media, making the degree of external attention and scrutiny it has received not commensurate with the actual importance of the business. After detailed discussion by the board of directors, the company believes that exiting the global SSL/TLS business is the most beneficial decision for the company and shareholders. eMudhra said that for many certificate authorities, SSL/TLS is at the core of their entire business, while for eMudhra it is just one component of its broader portfolio of digital trust solutions. In the future, resources will be concentrated on core business areas that can create higher value for customers.
In terms of customer transition arrangements, eMudhra stated that its G1 RSA root certificate system will continue to provide services during the transition period, and the company will work with the browser project organization and customers to complete the migration work. Affected customers will receive free certificate replacement services, and related replacements will be completed through partners. The certificate revocation and status query service will continue to run until all issued certificates are replaced or expire naturally. In the meantime, the company will continue to meet its remaining obligations to the Browser Root Certificate Program, including submitting a complete root cause analysis report.
eMudhra specifically emphasized that the decision to withdraw will not affect the company's other core businesses. The infrastructure used for global SSL/TLS certificate services is independent of the company's other business systems. The company's Digital Signature Certificate (DSC), eSign electronic signature service, enterprise PKI platform (emCA and CertiNext), emSigner electronic signature suite, and identity authentication solutions SecurePass and emAS will continue to operate normally.
Public information shows that eMudhra has more than 17 years of experience in digital trust services, and its business covers more than 35 countries and regions around the world. It mainly provides digital identity, trusted authentication and network security solutions for financial institutions, enterprises and government customers. Its products cover PKI and certificate life cycle management, identity and access management, multi-factor authentication, and data privacy compliance management.
Comments