eMudhra says global TLS incident did not affect Middle East and Africa customers

eMudhra says a security incident involving eight intermediate certificate authorities in its Global TLS business did not disrupt any customers, services or applications across the Middle East and Africa. The company is offering extra certificate redundancy at no cost while it completes a root-cause review and remediation plan.

Why it matters: - eMudhra says customers in the Middle East and Africa can keep using their existing TLS deployments and enterprise applications without taking action. - The company is also adding backup certificate options to reduce future disruption risk if another certificate authority hierarchy is revoked or distrusted.

What happened: - eMudhra confirmed that a security incident involving a specific set of intermediate certificate authorities in its Global TLS business had no impact on its customers, services or applications across the Middle East and Africa. - The incident involved eight intermediate CAs tied to a specific Global TLS hierarchy. - None of the affected intermediates issued end-entity certificates. - eMudhra said its investigation found no compromise of infrastructure or customer data. - The impact from distrust of the affected hierarchy was confined to a single customer ecosystem in the United States. - No action is required from customers in the Middle East and Africa related to their existing infrastructure, TLS deployments or eMudhra enterprise applications.

The details: - The unaffected regional services include eMudhra’s TLS certificate services in the Middle East and Africa. - The unaffected enterprise portfolio includes emSigner, emCA, CertiNext, SecurePass and Privatrust. - eMudhra is making Sectigo-issued TLS certificates available as an alternate option at no additional cost. - The alternate certificate option also applies to customers whose existing certificates were not affected by the incident. - eMudhra described the move as a proactive CA redundancy measure, not a remediation requirement for regional customers. - The redundancy approach is meant to let customers maintain certificates from more than one independently operated publicly trusted CA. - eMudhra said that setup is intended to improve flexibility and business continuity if a future revocation, distrust or similar ecosystem event affects one CA hierarchy. - The company is conducting a broader investigation into key-generation processes, operational controls, governance and how the issue remained undetected. - eMudhra said it will publish its root-cause analysis and relevant remediation measures to appropriate stakeholders in due course. - The company is continuing to engage with browser and root-store programs and the wider WebPKI community. - All confirmed updates on the incident, scope, customer impact and remediation are being maintained at the company’s incident update page. - Arvind Srinivasan, EVP & Director at eMudhra, said the company is committed to transparency, diligence in remediation and proactive resilience improvements.

Between the lines: - eMudhra is trying to separate a narrow certificate-authority issue from its broader regional business. - The company is also using the incident to signal stronger operational controls and a more resilient trust infrastructure. - The emphasis on no regional impact suggests eMudhra wants to limit customer anxiety in a market the company calls strategically important.

What's next: - eMudhra will continue its root-cause analysis and internal remediation work. - The company plans to share findings and remediation measures with relevant stakeholders once the review is complete. - eMudhra says it will keep investing in local capability, technology, customer support, security, resilience and digital trust infrastructure across the Middle East and Africa. - The company will continue to support governments, financial institutions and enterprises in the region through its digital signature, PKI, certificate lifecycle management, identity, authentication and trusted transaction tools.

The bottom line: - eMudhra says the TLS incident was limited in scope, did not affect customers in the Middle East and Africa, and will not require action from regional users.