EMudhra plans to exit global certificate business after security lapse

Traders Union
All News
Business & Wealth
Companies
EMudhra global certificate business

Highlights

eMudhra decided to exit the global website certificate business following a security flaw, affecting 30,000 certificates issued under the G3 root.
The global certificate business accounts for only 1 percent of the company’s total global revenue; following the exit, the focus will shift to its enterprise solutions business.
Revenue is expected to be affected by 5–7 percent over the next few quarters, with plans to strengthen operational security, conduct internal assessments and obtain third-party assurance.

This article was translated from the original. Read the original version by our correspondent here.

Security lapse, response and exit plan

In an interview with Forbes India, eMudhra co-founder Kaushik Srinivasan said the issue was caused by a scripting error and a lack of human oversight, resulting in cryptographic keys being used in eight certificates that researchers could crack in a very short time. Google, Mozilla, Apple and Microsoft subsequently blocked the affected keys, and the company decided to exit the global website certificate business.

According to the company, the affected route is its G3 root, through which approximately 30,000 certificates were issued. Customers affected are being moved to G1 and alternative partners. Srinivasan said the direct impact on Indian customers is limited and that the company’s India-based business remains unaffected.

He said the keys met standards in terms of length, but could be mathematically broken. According to him, the issue arose during an additional step involving the export and import of keys for global operations. Delays in hardware shipments to the U.S. in 2025 meant the key could not be generated locally there, so it had to be generated in India and exported.

The company says an external researcher sent a report on the night of October 17, after which eMudhra revoked the affected intermediates the following day. According to Srinivasan, the situation escalated rapidly after Mozilla published a blog expressing distrust of the G3 root, although he said there had been no reported infrastructure breach or data leak.

Revenue impact and focus on enterprise business

Srinivasan said the global certificate business accounts for only 1 percent of the company’s total global revenue, while carrying higher compliance costs and operational burdens. According to him, the business is rapidly becoming commoditized, several competitors are offering free certificates, and a framework with certificate lifetimes of 90 to 100 days is set to become the industry standard next year.

Against this backdrop, the board considered a voluntary exit the better option, taking into account its accountability to shareholders and returns on investment. Srinivasan said the company is now focused on increasing investment and accelerating growth in its enterprise solutions business. It also plans to strengthen operational security controls, conduct internal assessments and obtain third-party assurance.

He also said the company is considering incorporating AI as an additional review layer in some checks and balances. He estimates that revenue could be affected by 5 to 7 percent over the next few quarters, but added that discussions with customers are ongoing and the company does not expect a major business shock.

Our previous report discussed the ‘hype versus practical utility’ challenge facing Indian businesses amid the growing AI and LLM boom . It explained that adopting AI under pressure from FOMO and hype, without assessing tangible ROI, reliability and operational/cyber risks, could negatively affect long-term security and resilience.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.