eMudhra sees 5–7% revenue impact after security lapse, says co-founder

eMudhra could see a 5–7% impact on its top line over the next one to two quarters following a security incident involving eight intermediate certificate authorities, its co-founder Kaushik Srinivasan said. The company on Thursday announced its decision to exit the global SSL/TLS certificate business following the incident, which exposed weaknesses in cryptographic keys used to issue website security certificates.

The potential revenue impact could extend well beyond the segment’s direct contribution to the business. eMudhra has said its global SSL/TLS certificate operations account for around 1% of its global revenue.

“In our overall assessment, we feel that there may be a 5% to 7% top-line impact over the next one, two quarters, after which I think it should kind of normalise,” Srinivasan told Fortune India in an interview.

He said the company had spoken to customers across markets and geographies. However, he did not provide a detailed breakdown of how the projected impact would arise or how much could be attributed to the exit, customer migration or reputational fallout.

Script error behind weak keys

Explaining the incident, Srinivasan attributed the problem to an error in the code used during a key-generation process, along with human oversight.

“There was a script error, right? And then there was obviously human oversight that resulted in this kind of incident,” he said.

The process involved an additional export-import step for keys intended for global operations. “It’s a piece of code that the team had created to run that day because any key generation ceremony, there’s a piece of code that you run to create the keys,” he said. “This one had an additional export-import process baked in.”

The weakness went undetected for around 18 months despite external audits. Srinivasan said the annual audits covered key-generation ceremonies, but could not explain why the issue had escaped detection.

“The outcome was not what we expected, it’s not what the team expected,” he said, describing the incident as a one-off.

The government’s cybersecurity agency CERT-In said the affected P-384 private keys had been generated with insufficient cryptographic randomness and could be recovered almost instantly from their corresponding public keys. The advisory concerned eMudhra’s international website-certificate business, not its Indian digital-signature and eSign services.

Independent audit still pending

Srinivasan said an independent auditor would be appointed to investigate the incident, with the findings to be made public.

“We are just finalising, so in the next few days, we will do that and in all transparency, we will publish the findings to the public,” he said. He expected the review to take two to three weeks.

The company plans to introduce additional maker-checker and reviewer controls in its key-generation processes. It is also considering automated checks, potentially using artificial intelligence, to identify problems as they occur.

Srinivasan said eMudhra had found no evidence of exploitation. The company maintains that none of the affected intermediate certificate authorities had issued end-entity certificates and that its infrastructure had not been breached. Those conclusions remain subject to the independent review.

Incident accelerated exit decision

Srinivasan said the board had already been considering the commercial viability of the SSL/TLS business because of rising compliance costs and competition from providers offering certificates free of charge. He said the security incident accelerated the decision.

“This only necessitated a quicker decision on this towards a certain path,” he said.

The company has committed to transitioning affected customers to alternative providers without charge and said it would bear the cost. Srinivasan said one customer in North America had been affected through the distrusted G3 trust chain.

He maintained that eMudhra’s Indian digital-signature, eSign and enterprise solutions operate on separate infrastructure and remain unaffected. The company is also reviewing its operational security controls as it prepares to withdraw from the global certificate business.