eMudhra exits global SSL/TLS certificate business after security incident
Synopsis
eMudhra, one of India's leading digital trust providers, is walking away from the global SSL/TLS certificate market — not because of a breach, but because a security incident shone a spotlight the company felt was too large for a business worth just 1% of its revenue. The board's call to exit, rather than rebuild trust in the segment, signals a clear-eyed prioritisation of reputational capital over market breadth.
Key Takeaways
eMudhra Limited announced on 22 October 2026 it will voluntarily exit the global SSL/TLS certificate business.
The decision follows a security incident; affected certificate authorities (CAs) were revoked within 14 hours of detection.
The company confirmed no end-entity certificates were issued through affected CAs, no infrastructure was compromised, and no customer data was breached .
The SSL/TLS segment accounted for just 1 per cent of eMudhra's global revenue.
Srinivasan said reputational attention was disproportionate to the segment's scale, and the exit allows focus on strategic growth areas.
eMudhra Limited, a New Delhi-headquartered digital trust solutions provider, on Thursday, 22 October 2026, announced its board has decided to voluntarily withdraw from the global SSL/TLS certificate business following a recent security-related incident that drew significant scrutiny from the industry and stakeholders. The company said the segment contributed just 1 per cent of its global revenue, making the growing compliance and reputational burden no longer justifiable.
What Triggered the Exit
The decision comes in the wake of a security incident involving eMudhra's global SSL/TLS certificate infrastructure. According to the company, the affected certificate authorities (CAs) were revoked within 14 hours of detection, and the issue was disclosed promptly to stakeholders. The company maintained that no end-entity certificates were issued through the affected CAs, its infrastructure was not compromised, and no customer data was breached.
The firm also stated that all physical and logical security controls remained fully intact throughout the incident — a position it has communicated formally in its official statement.
What eMudhra's Chairman Said
V. Srinivasan, Chairman, eMudhra Limited, acknowledged that the attention generated by the incident was disproportionate relative to the scale of the SSL/TLS segment within the company's broader operations. He indicated that the board concluded an exit was in the best interests of the company and its shareholders, freeing up management bandwidth to focus on strategic growth areas.
'eMudhra Limited, a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business,' the company said in its official statement.
Why the Segment Was Already Under Pressure
Even before the incident, eMudhra noted that the SSL/TLS certificate business had become increasingly difficult to sustain. Rising compliance requirements, evolving data sovereignty regulations across geographies, and mounting infrastructure costs had made the segment operationally complex relative to its revenue contribution. At approximately 1 per cent of global revenue, the business was described internally as not justifying the resources and management attention it demanded.
Notably, the global public-key infrastructure and CA space has faced intensifying regulatory scrutiny in recent years, with browser vendors and standards bodies tightening requirements around certificate issuance, revocation timelines, and audit obligations.
Impact on Core Business and What Comes Next
eMudhra has emphasised that this exit is confined to the global SSL/TLS certificate segment and does not affect its broader digital trust, eSign, and enterprise identity offerings, which form the core of its revenue base. The company is expected to redirect operational focus and capital toward higher-growth segments within its portfolio.
The manner in which eMudhra communicates its transition plan to enterprise clients currently relying on its SSL/TLS certificates — and the timeline for winding down that business — will be closely watched by the industry in the weeks ahead.
Point of View
But it also sets a telling precedent: when the compliance overhead of operating a public CA outweighs revenue contribution, even established players will walk away. The global SSL/TLS market is consolidating around a handful of well-capitalised players, and the regulatory bar — set by browser vendors and standards bodies — has risen sharply. What this episode really underscores is how perilous it is to operate a public CA as a side-of-the-desk business; the consequences of any incident, however contained, are disproportionately public. For eMudhra's core business, the exit is clean — but the reputational echo in enterprise sales cycles may linger longer than the company's statement suggests.
NationPress
22 Oct 2026
Frequently Asked Questions
Why is eMudhra exiting the SSL/TLS certificate business?
eMudhra is exiting the global SSL/TLS certificate business because a recent security incident drew scrutiny that the company deemed disproportionate to the segment's size — just 1 per cent of its global revenue. The board concluded that rising compliance requirements, data sovereignty regulations, and infrastructure costs made the business unsustainable relative to its contribution.
Was customer data compromised in the eMudhra security incident?
No. eMudhra confirmed that no customer data was breached and its infrastructure was not compromised. The company said no end-entity certificates were issued through the affected certificate authorities, and all physical and logical security controls remained intact throughout the incident.
How quickly did eMudhra respond to the security incident?
eMudhra revoked the affected certificate authorities within 14 hours of detecting the issue. The company also disclosed the incident promptly to stakeholders, according to its official statement.
Will eMudhra's core digital trust business be affected by this exit?
The company has indicated the exit is confined to the global SSL/TLS certificate segment only. eMudhra's core offerings — including digital signatures, eSign, and enterprise identity solutions — are unaffected, and the company says it will redirect focus and resources toward these strategic growth areas.
What happens to customers currently using eMudhra SSL/TLS certificates?
eMudhra has not yet publicly detailed the transition timeline for existing SSL/TLS certificate customers. The manner in which the company manages this wind-down — including certificate validity periods and migration guidance — is expected to be communicated in the weeks ahead.
