The Indian certifying authority will stop serving the global web-security certificate market after reports that eight of its web-security keys leaked, while continuing domestic digital-trust services.

BulletsIn

• eMudhra, a licensed Indian Certifying Authority for digital signatures, has decided to exit the global web-security certificate business.
• The decision follows reports that eight of the company's web-security keys had leaked.
• Compromised keys can be used to impersonate legitimate websites and intercept encrypted communications.
• Certificate Authorities issue the digital certificates that enable the SSL/TLS encryption behind secure HTTPS browsing.
• A breach of a Certificate Authority's keys can undermine trust in the wider certificate ecosystem and may lead browser vendors to revoke trust in its certificates.
• The exit covers only the global certificate segment, and eMudhra continues its domestic digital-signature and digital-trust services.
• Those domestic services include Aadhaar-based e-signatures, digital locker services and other identity-verification infrastructure.
• Browser vendors and security researchers have in recent years distrusted or removed several Certificate Authorities worldwide after security lapses.
• The episode shows how a security lapse at a trust-infrastructure firm can quickly become a major commercial and reputational cost.
• It strengthens the case for tighter oversight of Indian firms operating as global digital-trust providers.

Tags: eMudhra, CertificateAuthority, DigitalTrust