eMudhra Exits SSL/TLS Certificate Business After CA Key Compromise, Shares Down 40% in Three Sessions

The Quick Take

• eMudhra will exit the global SSL/TLS certificate business following a security incident involving compromised private keys in eight intermediate Certificate Authority certificates.
• The security breach and forced business exit have driven a 40% decline in eMudhra shares across three consecutive trading sessions.
• The loss of Certificate Authority trust status removes a meaningful revenue stream and raises governance questions about the digital trust company.

eMudhra decision to exit the global SSL/TLS certificate business is a direct and unavoidable consequence of one of the most reputationally damaging events a Certificate Authority can experience: compromised private keys. In the certificate authority hierarchy the security of intermediate CA certificates is foundational. Any breach requires immediate revocation and notification to browser vendors including Google, Apple and Mozilla who then flag certificates from the compromised CA as unsafe in their products. The loss of browser trust status effectively makes an SSL/TLS business non-operational because certificates issued by a distrusted CA are rejected by all major web browsers globally.

The 40% stock decline across three sessions reflects the market assessment that SSL/TLS segment represented meaningful strategic and economic value, and that the governance failure extends reputational risk to the company core digital signature and trust services in India. eMudhra is a licensed Certifying Authority under India Information Technology Act, and the compromise raises serious questions about the company overall PKI security practices at the board level. Indian corporate and government customers relying on eMudhra digital signature certificates will monitor the regulatory response from India Controller of Certifying Authorities closely.

Watch for the CCA formal investigation findings and any conditions imposed on eMudhra Indian CA license as the most important near-term regulatory catalyst. The company roadmap for replacing SSL/TLS revenues with expanded digital signature, eSign and identity services will determine whether the core India business can compensate for the lost international segment. Whether the security incident attracts scrutiny from international customers of eMudhra cloud-based digital trust platform could determine whether the 40% decline is an overshoot or merely the first tranche of a larger rerating.

Synthesized from 1 source.