Update 2 - India’s eMudhra triggers global alert due to security vulnerability, exits website security business

Add quotes and details throughout the article

Abhirami G

Reuters, October 22 - Digital security company eMudhra (EMUD.NS) is withdrawing from its digital certificate issuance business for global websites, including India’s tax portal. The move comes after major browser providers blocked its certificates due to security vulnerabilities, which had sparked global cybersecurity concerns.

On Thursday, the company announced this decision, after tech giants including Google GOOGL.O, Apple AAPL.O and Microsoft MSFT.O stopped trusting its SSL/TLS certificates—tools used to encrypt data exchanged between users and websites to prevent interception by hackers.

The vulnerabilities were revealed over the weekend, when an independent cybersecurity researcher discovered that several of eMudhra’s main certificates had exploitable flaws.

eMudhra’s clients range from IT giants Infosys (INFY.NS ) and TCS (TCS.NS) to government agencies, with its certificates protecting high-profile sites including India’s Income Tax portal.

“eMudhra’s certificates are widely trusted internationally, and such vulnerabilities have created a trust crisis in global cybersecurity,” said Mredul Sarda, founder of San Francisco-based cybersecurity company Causal Security.

In a statement, eMudhra said the vulnerability had gone unnoticed for the past 18 months and had passed through two rounds of audits.

Co-founder Kaushik Srinivasan told Reuters that the flaw stemmed from eight private keys generated by eMudhra in April last year, which their software mistakenly shortened, greatly reducing security.

Cryptographic keys are long strings used to encrypt and decrypt data when processed through algorithms. But eMudhra’s keys were too short in length, making the encryption easier to break.

“As soon as a certificate authority is compromised, attackers can impersonate any website,” said Lukasz Olejnik, independent consultant and visiting senior researcher at King’s College London’s Department of War Studies.

While browsers quickly blocked the compromised certificates, networked devices that update less frequently may still be at risk. “Millions of old devices could remain vulnerable for years, or even forever, because they will continue to trust those certificates,” Olejnik said.

The Indian Computer Emergency Response Team said on Wednesday that some of eMudhra’s intermediate certificates had been compromised.

eMudhra said it has revoked the eight certificates, but insisted that its infrastructure was not affected and no data was breached.

The company said that attention on social media has brought disproportionate scrutiny to this business segment, which only accounts for 1% of its revenue.

Investor reaction was sharp, and within two days of the vulnerabilities being revealed, eMudhra’s share price fell by 40%.

(To assist non-English speakers, Reuters has automated the translation of its reports into several other languages. Automated translation may contain errors or fail to capture the required context, and Reuters does not guarantee the accuracy of the automated text. It is provided solely for reader convenience. Reuters accepts no responsibility for any damage or loss resulting from the use of automated translation.)