eMudhra to exit global SSL/TLS certificate business
Most companies in the PKI space are fighting to grab more market share in SSL/TLS certificates. eMudhra just walked away from the whole thing. The Bengaluru-based digital trust company announced this week that its board has decided to voluntarily exit the global SSL/TLS certificate business entirely. That's not a small pivot. That's leaving the front door of the industry.
I've been covering digital trust for years, and I can count on one hand the number of certificate authorities that have voluntarily retreated from the TLS market rather than selling out or getting pushed out. The space has become a race to the bottom. Margins are thin, automation is expected, and the big players like DigiCert and Sectigo have turned certificate issuance into a commodity service. eMudhra is betting that enterprise solutions and other trust services will pay the bills instead.
The company says it's sharpening its focus on "core enterprise solutions," which sounds like corporate speak for "we don't want to play in the browser trust store game anymore." But here's the thing that bugs me: SSL/TLS certificates are the most visible product in the digital trust world. If you're not issuing them, what exactly are you selling when you tell customers you're a "global digital trust company"? I'm genuinely curious whether this is a smart retreat from a dying market or a sign that eMudhra is struggling to compete where it matters most.
Industry Impact
I think this reads less like a retreat and more like a recognition that the public SSL/TLS market has become a race to the bottom that eMudhra was never going to win. Let's Encrypt commoditized domain-validated certificates years ago, and the browser vendors — Google and Apple primarily — keep raising the compliance bar for root programs, making it expensive to maintain trust stores for a business model built on volume. eMudhra is an Indian company with deep roots in digital signatures and PKI infrastructure for regulated sectors, so walking away from global SSL probably means they're cutting a drag on margins to focus on eSignatures and enterprise document signing, where Indian data localization laws actually create a moat.
What's interesting here is the geographic specificity. eMudhra isn't exiting certificates entirely; they're exiting the global market. That suggests they're betting that their future lies in the Indian regulatory environment — RBI guidelines, IT Act compliance, government tenders — where having a local CA with local support beats a multinational's global scale. For Indian enterprises, this consolidation means fewer domestic options for SSL, but potentially tighter integration between their certificate needs and their digital signing workflows, which is where eMudhra actually built its reputation.
The real question is whether eMudhra can maintain margins in digital signatures and enterprise PKI without the revenue volume that SSL certificates provided. The Indian eSign market is growing, but it's also crowded — Capricorn, SafeScrypt, and global players all want a piece of government and banking contracts. If the unit economics of regulated digital trust don't pan out at eMudhra's scale, this withdrawal might look less like strategic focus and more like conceding that the global market was never theirs to win. I'm watching to see if they can actually monetize the compliance advantage they're betting on, or if they've just traded one crowded market for another.
Conclusion
eMudhra is cutting loose its SSL/TLS business because it represents roughly 1% of global revenue while the compliance burden keeps compounding. That math checks out. But the more interesting detail is the board's stated reason for acting now: social media turned some incident into scrutiny that was wildly out of proportion to the business's actual size. When a company decides it's cheaper to abandon a line of business than to fight a narrative about it, that tells you something about how fragile corporate reputation has become in the certificate world.
What strikes me is the irony of a "digital trust" company exiting the business of issuing the certificates that establish trust on the web. They're keeping the enterprise solutions, the PKI infrastructure, the higher-margin consulting—but walking away from the commodity SSL/TLS layer that most people actually associate with web security. I'm still not sure whether this is smart pruning of dead weight or a retreat from the core mission. My guess is we'll see more regional CAs make the same calculation as data sovereignty rules keep fragmenting the market. The SSL/TLS business is getting harder to run globally, and 1% revenue doesn't buy much patience.