The vulnerabilities came to light after an independent cybersecurity researcher discovered that several of eMudhra’s key certificates could be attacked.
Digital security firm eMudhra will reportedly withdraw from the global website security certificate business after major browser makers, including Google, Apple and Microsoft, withdrew trust in its certificates over vulnerabilities that triggered cybersecurity concerns worldwide.
The company announced its exit on Thursday, news agency Reuters reported. eMudhra said the attention on social media had resulted in disproportionate scrutiny of a business that contributes just 1 per cent of its revenue.
The company’s SSL/TLS certificates encrypt communications between websites and users to protect data from unauthorised interception.
eMudhra’s customers include IT majors Infosys and TCS, as well as government agencies. Its certificates also protected critical websites, including India’s income-tax portal.
The vulnerabilities came to light over the weekend after an independent cybersecurity researcher discovered that several of eMudhra’s key certificates could be attacked.
The company said it had revoked eight certificates but maintained that its infrastructure had not been compromised and no data breach had occurred, reported Reuters.
Investors have reacted sharply to the disclosure, with eMudhra’s shares falling 40% over the two days following the revelation.
The flaws originated in eight cryptographic keys generated by eMudhra in April last year. The keys were inadvertently shortened by the company’s software, making them significantly weaker, co-founder Kaushik Srinivasan told Reuters.
Cryptographic keys are strings of characters used by encryption algorithms to secure data. When these keys are too short, they can become easier for attackers to crack, potentially compromising the security of encrypted communications.
