eMudhra quits SSL business after browsers block its certificates over cybersecurity concerns

Digital security firm eMudhra is exiting its global business of issuing security certificates for websites including India's tax portal after major browser makers blocked them for vulnerabilities that sparked worldwide cybersecurity concerns.

The company announced its decision on Thursday after technology giants including Google, Apple and Microsoft stopped trusting its SSL/TLS certificates, which encrypt data sent between users and websites to keep hackers from intercepting it.

The vulnerabilities came to light over the weekend, when an independent cybersecurity researcher found several of eMudhra's main certificates could be attacked.

EMudhra's customers range from IT majors Infosys and TCS to government agencies, and its certificates protect sites as important as India's income-tax portal.

"EMudhra's certificates are internationally accepted, and a vulnerability like this has created a trust deficit among the global cybersecurity landscape," said Mredul Sarda, founder of San Francisco-based cybersecurity firm Causal Security.

The vulnerability went undetected for the last 18 months and passed two rounds of audits, eMudhra said in its statement.

The flaws stemmed from eight keys eMudhra generated in April last year that were mistakenly shortened by its software, making them significantly weaker, co-founder Kaushik Srinivasan told Reuters.

Cryptographic keys are long strings of characters used to encrypt and decrypt data when passed through an algorithm. But eMudhra's keys were small enough to make the encryption easier to break.

"A single compromised certificate authority can impersonate any website," said Lukasz Olejnik, independent consultant and visiting senior researcher at the Department of War Studies at King's College London.

Browsers quickly blocked the compromised certificates but less frequently updated internet-connected devices could remain exposed. "Millions of older devices may remain at risk for years, or forever, because they will still trust those certificates," Olejnik said.

India's Computer Emergency Response Team said on Wednesday some eMudhra intermediate certificates had been compromised.

EMudhra said it had withdrawn eight certificates, but maintained its infrastructure was not compromised and that no data was breached.

Social media attention had brought disproportionate scrutiny to a business that accounts for just 1% of its revenue, the company said.

Investors have reacted sharply, with eMudhra shares down 40% in the two days since the vulnerability was disclosed.