eMudhra to exit overseas web security certificate business as stock takes beating

eMudhra Ltd., whose intermediate security certificates’ private keys were exposed on Tuesday in an extraordinary security incident, will exit the global business for offering web security certificates, the firm announced on Thursday, after the firm’s stocks hit the circuit breaker for two trading sessions. The incident may have wide-ranging consequences, since eight web security certificates can now be issued by attackers that seem legitimate to devices that have not received updates to distrust them.

The firm will continue the business that it is engaged in for issuance of SSL certificates for Indian websites, a spokesperson for the firm told The Hindu.

The firm said that web security certificates issued for non-Indian subscribers accounted for less than 1% of their revenue but was causing a disproportionate amount of reputational loss for the company, which lost more than a third of its market value in the 48 hours after word of the incident went public. eMudhra’s web and document signing technologies are used all over government and private industry. The IT Ministry has constituted a committee to look into the incident.

Kaushik Srinivasan, eMudhra’s co-founder, told The Hindu in an interview on Thursday before the firm announced the exit, that “perception threats have arisen” for the firm following the incident. “This is a one-off incident on a bad day,” Mr. Srinivasan insisted. “A script error can happen to anybody, right? The key lesson for us is, it’s more like once bitten, twice shy. Therefore, we will obviously put in place rigorous operational security controls.”

“We have not seen any significant negative feedback from any one of them, and we are quite deeply humbled by the support that we are getting from our customers,” Mr. Srinivasan said. 

An independent firm not involved with past audits that failed to spot the weak intermediate certificates would be appointed for a review of the firm’s security practices, Mr. Srinivasan said. 

Mr. Srinivasan shrugged off concerns that forged certificates based on eMudhra’s exposed private keys could be used in cyberattacks on smart devices. “Smart devices generally rely on certificates that are more private trust, not as much on public trust,” he said. “None of the use cases that we served on smart devices relied on any kind of public trust certificates.”

eMudhra has replied to queries by the IT Ministry’s committee, and will continue to engage with them, Mr. Srinivasan added.