SUMMARYeMudhra said it is exiting the global TLS certificate business after scrutiny over eight weak intermediate credentials, including one with a private key value of 4 that could have allowed anyone to mint certificates for websites or mail servers. Chairman V. Srinivasan cited rising compliance costs, low revenue from the business, and competition from free certificate providers as reasons for the withdrawal.
eMudra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.
V. Srinivasan, chairman of India-based eMudhra Limited, cited increasing costs and complexities of compliance requirements—paired with the business generating just 1 percent of its revenue. He also said that the emergence of organizations providing TLS certificates free of charge further reduced returns on investment when compared to other products and services the company offers.
Don't let the door hit you on the butt
“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company continued in a Thursday post. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.”