eMudhra Exits Global TLS Business After Issuing Weak Certificates
eMudhra is exiting the global TLS business after issuing eight weak intermediate certificates, one with a private key of 4.
V. Srinivasan, chairman of eMudhra, cited increasing costs and complexities of compliance requirements and said the TLS business generated just 1 percent of the company's revenue. He also said the emergence of organizations providing TLS certificates free of charge further reduced returns on investment compared with other products and services the company offers.
In a Thursday post, the company said social media amplification around the incident had brought scrutiny that was “out of proportion to SSL/TLS’s place in our business.” The board, after detailed deliberations, concluded that withdrawing from global SSL/TLS was “the right decision for eMudhra and its shareholders,” the post said.
The move follows the disclosure of the eight intermediate TLS credentials. Ars Technica reported that the credentials were so weak that anyone could mint certificates for any website or mail server, and that one had a private key of 4. eMudhra said the decision reflected compliance costs, the small revenue contribution from SSL/TLS and competition from free certificate providers. The company described the scrutiny as disproportionate to SSL/TLS’s role in its business.