A digital signature certificate (DSC) is the electronic equivalent of your handwritten signature, issued under the Information Technology Act, 2000 by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA). Directors, partners, authorised signatories, CAs and CSs, exporters and tender bidders need a Class 3 DSC to sign filings on MCA, GST, income tax, ICEGATE and e-procurement portals.
What is a digital signature certificate?
Section 3 of the IT Act lets a subscriber authenticate an electronic record by affixing a digital signature created through an asymmetric key pair: a private key that only you hold and a public key that anyone can use to verify your signature. The digital signature certificate is the electronic document, issued by a Certifying Authority (CA), that binds your verified identity to that public key. Section 5 then gives such a signature the same legal standing as a physical signature wherever a law requires a document to be signed.
The CCA does not issue certificates to the public. It licenses and audits CAs, publishes the Certificate Policy for India PKI and the Identity Verification Guidelines (CCA-IVG, version 2.6 dated 16 June 2026), and it is these guidelines that decide how your identity must be checked. Today the CCA lists 23 licensed CAs, of which the commercial ones such as eMudhra, Capricorn, (n)Code Solutions, Protean, IDSign, Pantasign, Vsign, CDSL Ventures and ProDigiSign issue DSCs to businesses and individuals.
In practice you will hear only about Class 3. Under the current CCA-IVG, a standalone Class 2 individual signing certificate can no longer be issued; Class 3 individual certificates carry both the Class 2 and Class 3 policy identifiers, so portals that used to ask for Class 2 accept them. Class 3 is the highest assurance level in the Indian PKI and requires your key pair to be generated inside a FIPS-validated hardware token, which is why every DSC comes on a USB crypto token rather than as a file.
Who needs a digital signature certificate?
If any of the portals below is part of your business routine, someone in your organisation needs a valid DSC registered on that portal:
- Directors, designated partners and subscribers signing company or LLP incorporation and annual forms on the MCA V3 portal
- Authorised signatories of companies and LLPs filing GST registration, amendments and returns, where DSC signing is mandatory for these entities
- Companies and audited taxpayers who must digitally sign income tax returns and audit reports
- Importers, exporters and customs brokers registering on ICEGATE and signing customs documents
- Bidders on government e-procurement portals such as the Central Public Procurement Portal, state e-tender sites and GeM, who need a signing plus encryption DSC
- Chartered accountants, company secretaries and cost accountants certifying e-forms
- Trademark, patent and design applicants or their attorneys filing on the IP India portal
- Foreign directors and foreign nationals signing Indian filings
Benefits of Digital Signature Certificate (DSC)
Legally equivalent to a wet signature
Section 5 of the IT Act treats a document authenticated with a DSC as validly signed wherever a law demands a signature, so your e-filings stand up in scrutiny and in court.
Tamper evidence built in
The signature is mathematically tied to the exact content of the document. If even one character changes after signing, verification fails, which protects you against altered filings.
One token, many portals
A single Class 3 DSC can be registered on MCA, GST, income tax, ICEGATE, EPFO and e-tender portals, so one signatory can handle a full compliance calendar without paper.
Encryption for confidential bids
A combo (signing plus encryption) certificate lets you encrypt price bids on e-procurement portals so that nobody, including the department, can open them before the bid opening date.
Faster remote compliance
With Aadhaar or PAN based eKYC and video verification, directors who travel or live abroad can obtain and use a DSC without visiting any office.
Eligibility & certificate types
Any individual can obtain a personal DSC. What changes is the certificate category, which decides how the CA verifies you:
- Individual (personal) certificate: issued in your own name, verified through Aadhaar eKYC, PAN eKYC, banking eKYC or CA-assisted enrolment
- Organisational person certificate: shows your name and the organisation's name; requires proof that the organisation exists, an authorisation letter from an authorised signatory and the signatory's own eKYC
- Foreign national certificate: for applicants whose ID or address is not issued by Government of India authorities, with video or telephonic verification
- Signing-only DSC: for MCA, GST, income tax and most compliance portals
- Signing plus encryption (combo) DSC: needed mainly for e-tendering and some ICEGATE functions
- Document Signer Certificate: an organisation certificate used for automated bulk signing of invoices or statements from a server, issued only after specific declarations
Documents required
Individual applicant
- PAN card (mandatory for most Indian applicants)
- Aadhaar linked to an active mobile number for OTP based eKYC, or an address-bearing government ID for PAN eKYC
- Recent passport-size photograph (captured live during the online process)
- Personal mobile number and personal email ID that are not shared with anyone else
Organisation DSC (additional)
- Organisation PAN and GST certificate, or certificate of incorporation with a bank statement
- Authorisation letter on letterhead signed by a director, partner or proprietor
- eKYC of the authorised signatory who issues the letter
- Proof of the applicant's association with the organisation, such as an ID card or appointment letter
Foreign national
- Passport (apostilled or consularised copy where the CA requires it)
- Proof of overseas address such as a bank statement, utility bill or residence card
- Overseas mobile number and email ID for OTP verification
- Organisation ID and authorisation letter if applying for an organisational certificate
Step-by-step process to get a DSC
The application is fully online. The steps below follow the sequence prescribed in the CCA Identity Verification Guidelines:
Choose class, type and validity
Decide between signing-only and combo, individual or organisational, and a validity of one, two or three years. If you plan to bid on tenders, choose combo now; an encryption certificate cannot be added to a signing-only DSC later.
Fill the application on the CA portal
Enter your name exactly as it appears on PAN. The CA sends OTPs to your mobile and email, and both must be verified before your eKYC account is activated.
Complete eKYC
Authenticate using Aadhaar OTP or offline Aadhaar XML, PAN with an address-bearing ID, or banking eKYC. For organisational certificates, the authorised signatory also completes eKYC.
Record the video verification
You record a short live video reading out a random code shown on screen while holding your ID. The CCA-IVG requires this to be done within two days before issuance, so do it immediately after the form.
CA verification and approval
The CA's verification officer matches your photo, video and documents, and for organisations may call the organisation's published phone number. Queries usually concern name mismatches or blurred video.
Download onto a FIPS token
Insert a FIPS-validated USB token, change its default password and download the certificate. The key pair is generated inside the token itself; the guidelines prohibit downloading to a token that still has its default password. Download within 30 days of approval or the verification must be repeated.
Register the DSC on each portal
Associate the DSC with your DIN on MCA, register it on the GST portal and income tax e-filing portal, and enrol it on ICEGATE or the e-tender site. Each portal keeps its own registration, so this step is repeated on renewal.
Cost of a digital signature certificate
There is no government or CCA fee payable by the end user. The price is a commercial charge set by the Certifying Authority or its registration authority and varies with class, type (signing or combo), validity and whether you also buy a USB token. Expect combo and foreign-national certificates to cost more than a signing-only individual DSC.
Professional charges are quoted separately after reviewing your case. Government fees are paid directly to the authority; for DSC, the certificate and token cost is payable to the Certifying Authority.
How long does it take?
When your Aadhaar mobile is active and your PAN name matches, a DSC is often issued the same day. Delays come from the human verification queue at the CA, rejected video, or, for organisational DSCs, waiting for the authorised signatory to complete their own eKYC.
| Stage | Typical time |
|---|---|
| Application, OTP and eKYC | 15 to 30 minutes |
| Video verification | A few minutes; must be within 2 days before issue |
| CA approval | A few hours to 2 working days |
| Download to token | Within 30 days of approval |
Validity & renewal
A DSC is issued for one, two or three years, and the CCA Certificate Policy sets three years as the maximum lifetime of a subscriber signing certificate. There is no true extension: renewal means applying for a fresh certificate, completing eKYC again and downloading it, usually onto your existing token if that token is still FIPS compliant. Because each portal stores the old certificate, you must re-register the new DSC on MCA, GST, income tax and ICEGATE before your next filing. Revocation is available through the CA if your token is lost or an employee leaves.
Using your DSC safely after issue
- Keep the token and its PIN in the signatory's own control; handing it to staff makes every filing legally yours
- Install the CA's token driver and signing utility (emSigner or the portal's own utility) before filing deadlines
- Associate the DSC with your DIN on MCA and register it on GST and income tax portals immediately
- Track expiry dates for every director and partner in a shared compliance calendar
- Request revocation from the CA when a token is lost or an authorised signatory leaves
- After too many wrong PIN attempts the token locks; resetting needs re-initialisation and a re-download, so keep the CA's re-issuance option in mind
Signing DSC vs Combo DSC vs Document Signer
| Feature | Signing DSC | Signing + Encryption (Combo) | Document Signer Certificate |
|---|---|---|---|
| Typical use | MCA, GST, income tax, EPFO filings | E-tenders, some ICEGATE functions | Automated bulk signing of invoices and statements |
| Issued to | Individual or organisational person | Individual or organisational person | Organisation only |
| Encrypts documents | No | Yes | No |
| Storage | FIPS USB token | FIPS USB token | Token or organisation HSM with attestation |
Common mistakes & rejection reasons
Name mismatch with PAN
MCA and GST check the DSC name against PAN records. A DSC carrying a nickname, a missing middle name or a different spelling will be issued but then refuses to register on the portal.
Buying signing-only for tenders
E-procurement portals need the encryption certificate to encrypt your bid. Bidders who buy a signing-only DSC discover the gap on the bid submission day.
Shared mobile or email
The CCA guidelines require the mobile and email to belong to the applicant. Using the office accountant's number or a common email ID leads to rejection or later lock-outs.
Poor video verification
Low light, a face partly hidden, reading the wrong code or showing a different ID than the one uploaded are the most frequent reasons for a CA query.
Default token password left unchanged
Downloads fail on tokens still carrying the factory password. Change it first and record the new PIN securely.
Forgetting re-registration after renewal
The new certificate has a different serial number. Filings fail on MCA or GST until the renewed DSC is associated again.
Penalties for misuse and misrepresentation
There is no penalty for not having a DSC, but every portal will simply refuse an unsigned filing, and late filing fees under the relevant law then apply. The IT Act punishes misrepresentation or suppression of material facts to obtain a certificate, and Section 73 separately punishes publishing a certificate known to be false in certain particulars. Allowing someone else to sign with your token does not shift liability: the law presumes the subscriber signed.
| Default | Consequence | Provision |
|---|---|---|
| Misrepresenting or suppressing a material fact to the Controller or a CA to obtain a DSC | Imprisonment up to 2 years, or fine up to ₹1 lakh, or both | Section 71, IT Act 2000 |
Practitioner tips
- Before applying, check how your name reads on the income tax PAN verification. Build the DSC name from that, not from your Aadhaar, to avoid MCA association errors.
- For a company with several directors, apply for all DSCs together with the same validity so that renewals and DIN associations fall in the same month.
- If you might bid on even one government tender in the next three years, take the combo certificate; it costs little more than signing-only and saves a fresh application.
- Ask the CA whether the token is FIPS 140-3 compliant. The CCA has issued notices on migrating from FIPS 140-2 devices, and newer tokens avoid compatibility problems on renewal.
- Foreign directors should complete video verification in daylight with their passport, and keep their overseas mobile active for OTPs during the window.
How Lawgical Guru helps
Choosing the right certificate
We map the portals you use to the correct class, type and validity, so you do not buy twice.
Application and eKYC support
We prepare the application with your licensed CA, guide you through OTP and video verification over a call, and handle verification queries.
Organisational and foreign DSCs
We draft the authorisation letter, line up the signatory's eKYC and help foreign directors with passport and address proof requirements.
Token setup and portal registration
We help install drivers, download the certificate and register it on MCA, GST, income tax, ICEGATE and e-tender portals.
Renewal tracking
We note every DSC's expiry against your compliance calendar and start renewal before it disrupts a filing.
Digital Signature Certificate (DSC): frequently asked questions
Is Class 2 DSC still available?
Not as a standalone individual signing certificate. The CCA Identity Verification Guidelines no longer allow CAs to issue a separate Class 2 individual signing DSC. Instead, Class 3 individual certificates carry both Class 2 and Class 3 policy identifiers, so they are accepted wherever Class 2 was earlier required. Organisational person certificates can technically be issued as Class 2 or Class 3, but almost all portals now expect Class 3.
Which DSC is required for MCA and GST filings?
A Class 3 signing DSC in the director's, designated partner's or authorised signatory's own name is sufficient for MCA V3 e-forms and GST. The name must match PAN records, and on MCA the DSC must be associated with the DIN before use. Companies and LLPs must sign GST applications and returns with a DSC, whereas proprietors and partnerships can also use Aadhaar-based EVC.
Do I need an encryption certificate for e-tendering?
Yes. Government e-procurement systems use the encryption certificate to lock your technical and financial bids until the opening date. A signing-only DSC lets you log in and sign, but you cannot encrypt and submit the bid. Choose a signing plus encryption, often called combo, certificate in the name of the authorised bidder before registering on the tender portal.
Can I get a DSC without visiting any office?
Yes. The CCA guidelines allow fully online issuance through Aadhaar online or offline eKYC, PAN eKYC or banking eKYC, combined with mobile and email OTPs and a recorded video verification. If you have no Aadhaar or your mobile is not linked, the CA can use assisted enrolment, which may involve meeting a CA representative in person.
How long is a digital signature certificate valid?
You can choose a validity of one, two or three years. The CCA Certificate Policy caps the lifetime of subscriber signing and encryption certificates at three years. Once the certificate expires you cannot extend it; you apply for a new DSC with fresh eKYC, download it and re-register it on each portal you use.
Can I use one DSC for multiple companies?
A personal DSC identifies you as an individual, so you can use it to sign filings for every company or LLP in which you are a director or partner, after associating it with your DIN on MCA. An organisational DSC is different: it carries one organisation's name and should be used only for that organisation.
What happens if my DSC token is lost?
Contact your Certifying Authority immediately and request revocation of the certificate. Revocation is recorded in the CA's certificate revocation list, so anyone who later tries to use the token cannot produce a valid signature. You will then need to apply for a fresh DSC and register the new certificate on all your portals.
Can a foreign national get an Indian DSC?
Yes. The CCA guidelines have a separate route for applicants whose identity or address documents are not issued by Indian authorities. You provide your passport, overseas address proof, mobile number and email, and complete video verification, or in some cases a telephonic verification. Many CAs also ask for attested or apostilled copies, so check with the CA before you start.
Is there a government fee for a DSC?
No. The Controller of Certifying Authorities does not charge end users. The price you pay goes to the licensed Certifying Authority or its registration authority and depends on the class, signing or combo type, validity period and whether a USB token is included. Prices therefore differ between CAs and resellers.
Why does my DSC not work on the GST or MCA portal?
The usual causes are a missing or outdated signer utility, a token driver that is not installed, an expired certificate, or a name on the DSC that does not match PAN. On MCA, the DSC must also be associated with your DIN. Updating the emSigner or portal utility and re-registering the certificate solves most cases.
Reviewed by Satyam Gupta, Company Secretary (CS) & Advocate
8+ years of industry experience. This page was last reviewed on 16 October 2026 against the official sources below. Rules and fees change — confirm on the official portal before you apply.