Security Firm Exits Security Business After, Well, Security Problem

eMudhra, India's digital authentication company, is exiting the SSL/TLS certificate business after eight of its certification authorities were found issuing security keys weaker than required. The stock plunged 20 per cent to Rs 345.25 on BSE. It's the professional equivalent of a swimming instructor quitting after nearly drowning.

Here's what went wrong: researchers discovered that eMudhra's compromised keys could be reverse-engineered using AI-assisted techniques, potentially enabling cybercriminals to create fraudulent platforms impersonating legitimate payment entities. That's not a bug. That's a feature for the wrong people. The vulnerability triggered global alarm, prompting Apple, Google, Microsoft and Mozilla to block the affected certificates across their browsers.

eMudhra's Chairman V Srinivasan insists the company handled it well, revoking affected CAs within 14 hours and disclosing promptly. He claims there were no end entity certificates issued from compromised authorities, infrastructure wasn't breached, no data leaked, and all security controls stayed intact. In other words: the problem was contained, just not prevented. Which is like saying the fire was put out, ignore the smoke.

The exit itself tells you something. SSL/TLS contributes roughly 1 per cent of eMudhra's global revenue. Rising compliance costs and free offerings from tech giants have gutted margins. So the math is simple: a business that's simultaneously tiny and reputationally toxic gets axed. Even eMudhra can read a spreadsheet.

There's one complication. The Ministry of Electronics and Information Technology licensed eMudhra to issue web security certificates for government websites, including the income tax portal. That portfolio doesn't vanish because margins are bad. The Ministry has launched a special investigation into the incident. Which means eMudhra's exit isn't really an exit. It's more like a very public timeout while adults decide what happens next.

The real irony? A company whose entire business is convincing the internet that things are secure just proved it can't keep anything secure. In a market where trust is literally the product, that's not a vulnerability. That's a death sentence dressed up as a business decision.