Digital Trust Company eMudhra Exits Global SSL/TLS Certificate Business

Digital trust company eMudhra has announced its decision to exit the global SSL/TLS certificate business entirely. The company stated that the board concluded the withdrawal was the right decision for eMudhra and its shareholders following extensive deliberations and disproportionate social media scrutiny surrounding a recent process gap.

Earlier, the company had indicated that its board would evaluate structural changes and additional safeguards after script errors occurred in certificates during a key-generation ceremony in April 2025. Moving away from this segment, eMudhra intends to concentrate its efforts on core enterprise solutions and trust services that extend beyond SSL/TLS.

The company noted that its G1 RSA roots will continue to serve customers during the transition period. eMudhra plans to collaborate with browser programmes and customers to facilitate the shift, offering to replace any affected certificates free of cost through partners. Revocation and certificate status services will remain active until all issued certificates either expire or are replaced, and the company will complete its remaining commitments to browser root programmes, including the submission of a full root-cause report.

eMudhra clarified that its Global Digital Signature Certificate (DSC), eSign, and other signing services within India and globally remain completely unaffected. The company's enterprise PKI solutions, such as emCA and CertiNext, the emSigner eSignature Suite, and identity and authentication solutions including SecurePass and emAS, will also continue normal operations.

The global SSL/TLS business accounted for approximately 1 per cent of eMudhra's global revenue. According to the company, rising data sovereignty and compliance requirements have increased both the complexity and cost of maintaining this business over time. Furthermore, the availability of free SSL/TLS certificates from some large entities significantly reduced the business potential and return on investment when measured against the company's cumulative revenue base.

Emphasizing its handling of the initial incident, eMudhra stated that it revoked the affected CAs within 14 hours of discovery and made prompt disclosures. The company confirmed that no end-entity certificates were issued out of the affected CAs, its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.

"A strategic decision to exit a low-margin segment that accounts for a minute fraction of overall revenue is a pragmatic step for corporate governance, especially when compliance costs and market complexities rise. For technology companies, pivoting core resources toward high-value enterprise solutions and protecting the primary revenue-generating portfolio ensures long-term operational stability and shareholder value." — Dr. Shishir Gupta, Founder & CEO, StartupLanes