eMudhra to exit global SSL/TLS certificate business after key compromise disclosure

Bengaluru-based eMudhra announced it is leaving the global SSL/TLS certificate business entirely, following the disclosure that eight of its intermediate private keys were trivially guessable. The company says it revoked the affected CAs within 14 hours of discovery and that no end-entity certificates were issued from them, with no infrastructure compromise or data breach. It cited SSL/TLS making up roughly 1% of its revenue, rising compliance costs, and free offerings from larger competitors. Its G1 RSA roots will keep serving customers during a transition period, and a root-cause report to browser root programs remains outstanding.