eMudhra, a Bengaluru-based digital trust company listed on both BSE and NSE, announced its board has decided to voluntarily exit the global SSL/TLS certificate business. The move follows a recent incident involving its certificate authority infrastructure — eMudhra says it revoked affected CAs within 14 hours, disclosed promptly, and confirmed no end-entity certificates were issued from the compromised CAs, no infrastructure was breached, and all physical and logical security controls remained intact. The company frames the exit as a rational capital-allocation decision. SSL/TLS contributes roughly 1% of eMudhra's global revenue. Chairman V. Srinivasan pointed to structural headwinds: rising data sovereignty and compliance costs, increasing operational complexity, and — critically — the fact that major players now issue SSL/TLS certificates for free. The return on investment for this line has "considerably reduced" against the company's cumulative revenue base. But the proximate trigger is reputational, not financial. Srinivasan said the "level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business." The board concluded that the tail risk of operating in a space where a single incident generates outsized public attention outweighs the marginal revenue. This is a company deciding the regulatory and reputational attack surface of web PKI isn't worth the candle. The transition plan is orderly. eMudhra's G1 RSA roots will continue serving customers during the wind-down. Affected customers will receive free replacement certificates from partner CAs. Revocation and certificate status services will run until every issued certificate expires or is replaced. The company will complete its remaining commitments to browser root programs, including a full root-cause report on the incident. eMudhra's core business is untouched. Its global digital signature certificate (DSC) services, eSign, enterprise PKI platforms (emCA, CertiNext), emSigner eSignature Suite, and identity and authentication solutions (SecurePass, emAS) all operate on separate infrastructure. The company serves banks, enterprises, and governments across 35+ countries with products spanning certificate lifecycle management, identity and access management, MFA, and data-privacy compliance. The broader signal is about the economics of public web PKI. When Let's Encrypt and Cloudflare issue domain-validated certificates at zero cost, the commercial SSL/TLS market compresses into a narrow band of extended-validation and organization-validated certificates — a segment where compliance overhead is high and margins are thin. For a diversified trust company like eMudhra, the math stops working. The browser root program's accountability regime — which demands public incident reports, rapid revocation, and community scrutiny — functions as intended but creates asymmetric risk for small-share participants. This is not a trust failure story. It's an economics story dressed up as a security story. eMudhra is exiting a commodity market where free alternatives dominate, compliance costs are rising, and a single incident can generate reputational damage wildly disproportionate to the business value at stake. The 17-year-old company is choosing to concentrate on enterprise PKI, digital signatures, and identity — markets where its India-centric regulatory expertise and government relationships are actual competitive advantages.
