eMudhra Withdraws from Global SSL/TLS Certificate Business After Security Vulnerabilities
Indian digital trust services provider eMudhra announced on October 22 that it would voluntarily exit the global SSL/TLS certificate business following the discovery of vulnerabilities in its issued certificates. The move comes after major browser vendors Google, Mozilla, Apple, and Microsoft blocked eMudhra’s certificates, raising concerns over internet security and privacy.
SSL/TLS certificates are critical for encrypting data between browsers and servers, protecting sensitive information from interception. eMudhra, which serves businesses and government agencies including India’s income tax portal issued certificates later found to be weak and vulnerable to exploitation. An independent researcher identified the flaws over the weekend, prompting India’s Computer Emergency Response Team (CERT-In) to issue an advisory on October 21, confirming that some of eMudhra’s intermediate certificates had been compromised.
In response, eMudhra revoked eight certificates and stated that its infrastructure remained unbreached, with no evidence of data compromise. The company downplayed the incident’s impact, noting that the SSL/TLS business accounts for just 1% of its revenue and that social media scrutiny had exaggerated its significance. However, the fallout was immediate: shares of eMudhra plummeted 40% in two days following the disclosure.
Among eMudhra’s clients are major Indian IT firms Infosys and TCS, underscoring the potential reach of the vulnerabilities. The incident highlights ongoing risks in digital certificate management and the broader implications for trust in online security infrastructure.
Source: https://finance.yahoo.com/technology/articles/indian-firm-emudhra-exits-global-123540524.html
Tata Consultancy Services cybersecurity rating report: https://www.rankiteo.com/company/tata-consultancy-services
"id": "TAT1792679271",
"linkid": "tata-consultancy-services",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Businesses and government '
'agencies, including India’s '
'income tax portal, Infosys, and '
'TCS',
'industry': 'Cybersecurity/IT Services',
'location': 'India',
'name': 'eMudhra',
'type': 'Digital Trust Services Provider'}],
'attack_vector': 'Weak/Vulnerable Certificates',
'date_publicly_disclosed': '2023-10-22',
'description': 'Indian digital trust services provider eMudhra announced it '
'would voluntarily exit the global SSL/TLS certificate '
'business following the discovery of vulnerabilities in its '
'issued certificates. Major browser vendors blocked eMudhra’s '
'certificates, raising concerns over internet security and '
'privacy. The vulnerabilities were identified by an '
'independent researcher, prompting CERT-In to issue an '
'advisory.',
'impact': {'brand_reputation_impact': 'Significant reputational damage due to '
'blocked certificates',
'financial_loss': 'Shares plummeted 40% in two days',
'operational_impact': 'Voluntary exit from SSL/TLS certificate '
'business',
'revenue_loss': 'SSL/TLS business accounts for 1% of revenue',
'systems_affected': 'SSL/TLS certificate infrastructure'},
'lessons_learned': 'Highlights ongoing risks in digital certificate '
'management and trust in online security infrastructure',
'post_incident_analysis': {'corrective_actions': 'Revoked certificates, '
'exited SSL/TLS business',
'root_causes': 'Weak/vulnerable intermediate '
'certificates'},
'references': [{'source': 'CERT-In Advisory'},
{'source': 'Independent Researcher'}],
'regulatory_compliance': {'regulatory_notifications': 'CERT-In advisory '
'issued on 2023-10-21'},
'response': {'communication_strategy': 'Downplayed incident impact, noted '
'social media exaggeration',
'containment_measures': 'Revoked eight certificates',
'remediation_measures': 'Voluntary exit from SSL/TLS certificate '
'business'},
'title': 'eMudhra Withdraws from Global SSL/TLS Certificate Business After '
'Security Vulnerabilities',
'type': 'Certificate Compromise',
'vulnerability_exploited': 'Compromised intermediate certificates'}