If you’ve been running a business in India, you’ve almost certainly come across the term Digital Signature Certificate — whether while filing GST returns, incorporating a company, or submitting a government tender. But what exactly is it?
A Digital Signature Certificate (DSC) is the digital equivalent of your physical signature — except far more secure and legally binding. Licensed Certifying Authorities (CAs), authorised by the Controller of Certifying Authorities (CCA) under the Ministry of Electronics & Information Technology, issue this encrypted electronic credential. Under Section 3 of the Information Technology Act, 2000, a DSC carries the same legal weight as a handwritten signature.
How it works: When you sign a document using a DSC, the system generates a unique cryptographic hash (digital fingerprint) for that document. It then encrypts the fingerprint using your private key, securely stored on a USB crypto-token, and embeds it into the document. The recipient verifies the signature using your public key. If the hash matches, the system confirms that the document is authentic and has not been tampered with.
Legal & Regulatory Framework
| Law / Authority | Relevance to DSC |
|---|---|
| IT Act, 2000 — Sec. 3 & 5 | Grants legal recognition to digital signatures; gives them the same legal validity as handwritten signatures |
| IT Act, 2000 — Sec. 17–34 | Establishes the Controller of Certifying Authorities (CCA) and regulates all Certifying Authorities issuing DSCs |
| Companies Act, 2013 | Mandates DSC usage for directors and authorized signatories filing forms on the MCA21 V3 Portal |
| GST Act, 2017 | Requires companies and LLPs to use DSCs for GST registration, return filing, and compliance activities |
| CCA Circular — Nov 2020 | Discontinued Class 2 DSCs effective from 01.01.2021; Class 3 DSC became mandatory for all users |
| CCA IVG Guidelines — July 2024 | Introduced mandatory Video KYC for DSC issuance. RA models still permit assisted verification through Aadhaar eKYC and PAN validation |
| Bharatiya Sakshya Adhiniyam, 2023 | Recognizes DSC-signed electronic records as legally admissible evidence in courts |
Types of Digital Signature Certificate — 2026 Status
The classification of Digital Signature Certificate classes changed significantly after January 2021. Here is where each class stands:
| Class | Status | Details |
|---|---|---|
| Class 1 DSC | Discontinued | Phased out before 2021. Verification was limited to name and email ID only. No longer accepted on government portals. |
| Class 2 DSC | Discontinued w.e.f. 01.01.2021 | Earlier used for Income Tax, ROC, and GST filings by directors and authorised signatories. After discontinuation, users were required to obtain a new Class 3 DSC, as automatic migration was not provided. |
| Class 3 DSC | Only Valid Class — 2026 | Highest assurance level DSC. Mandatory Video KYC verification. Issued on a FIPS 140-2/140-3 compliant USB token. Validity available for 1 or 2 years. Approximate cost ranges from ₹2,000–₹5,000. |
Today, Certifying Authorities issue only Class 3 DSCs. Companies, LLPs, and users involved in high-trust transactions must use them, while some portals still allow individuals to authenticate through EVC or Aadhaar-based verification. It comes in four sub-types:
| Sub-Type | Used For |
|---|---|
| Signing DSC | Income Tax, GST, MCA, ROC, TDS, and EPFO compliance filings |
| Signing + Encryption DSC | e-Tendering, e-Bidding, GeM Portal, and CPPP transactions where both signing and encryption are required |
| DGFT DSC | Import-export documentation, IEC applications, and filings on the DGFT Portal |
| Document Signer Certificate | Bulk automated document signing in ERP, banking, and enterprise systems using HSM or Cloud KMS infrastructure |
Where Is DSC Mandatory in 2026?
| Portal | Mandatory Use Cases |
|---|---|
| GST Portal (gst.gov.in) | GST registration, GSTR-1, GSTR-3B, GSTR-9, GSTR-9C filing, and refund applications (mandatory for companies and LLPs) |
| MCA21 V3 (mca.gov.in) | Company incorporation, annual return filings (AOC-4, MGT-7), DIR-3 KYC, director/address updates, and LLP filings |
| Income Tax Portal | ITR filing for companies and firms, along with audit report submissions under Section 44AB |
| GeM / CPPP / e-Tendering | Submission of government tenders, procurement bids, and e-auctions at central and state government levels |
| DGFT Portal (dgft.gov.in) | IEC registration, import-export documentation, and SEIS/MEIS incentive claims |
| EPFO Unified Portal | ECR filing and compliance submissions by authorised employer signatories |
| ICEGATE (Customs) | Filing of bills of entry, shipping bills, and customs documentation for importers, exporters, and customs brokers |
DSC Certifying Authorities — Who Can Issue Your DSC?
A DSC Certifying Authority licensed by the CCA under the IT Act, 2000, must issue a legally valid DSC. Multiple licensed Certifying Authorities operate in India, and the exact number may change based on CCA updates. A 2025 CCA advisory confirmed that all portals must accept DSCs from any licensed CA — no portal can restrict users to a specific CA. The major DSC Certifying Authorities are:
| DSC Certifying Authority | Known For |
|---|---|
| eMudhra Limited | India’s largest Certifying Authority; over 1 crore digital certificates issued; Aadhaar eKYC-based issuance |
| (n)Code Solutions (GNFC) | Government-backed Certifying Authority with a strong PSU and public sector presence |
| Capricorn CA | Fast DSC processing, GST-focused utilities, and strong adoption among SMEs and practicing CAs |
| Sify Technologies | India’s first licensed Certifying Authority under the IT Act, 2000; known for enterprise PKI expertise |
| NSDL e-Governance | Widely trusted by company secretaries, chartered accountants, and finance professionals |
| XtraTrust DigiSign | Quick Aadhaar eKYC-based issuance with PAN India service coverage |
How to Apply for a Class 3 DSC
Getting a DSC is straightforward. Here is the process:
1. Choose a CCA-licensed Certifying Authority and select your DSC type (Signing / Signing+Encryption / DGFT).
2. Fill in the online application with your name, PAN, Aadhaar, mobile number, and email. Select 1-year or 2-year validity.
3. Complete Video KYC — mandatory since July 2024. The CA’s Registration Authority will verify your identity in real-time using Aadhaar biometrics or PAN with face match. No paper-based process is permitted.
4. Upload self-attested documents: PAN card, Aadhaar card (or approved government ID), and a passport-size photograph. Organisational DSCs additionally require an authorisation letter and company registration documents.
5. Pay the fee online (UPI, net banking, or card) Cost typically ranges from ₹1,500 to ₹5,000 depending on the Certifying Authority, type, and validity period.
6. The Certifying Authority issues your DSC on a FIPS 140-2/140-3 compliant USB crypto-token and delivers it by courier within 3–7 working days. Some CAs also offer emergency processing within 24–48 hours at an additional cost.
Key Advantages of a DSC
| Benefit | What It Means |
|---|---|
| Legal validity | Recognized as equivalent to a handwritten signature under the IT Act, 2000 and admissible as evidence under the Bharatiya Sakshya Adhiniyam, 2023 |
| Tamper-proof | Any modification made after signing immediately invalidates the digital signature and can be detected by the recipient |
| Non-repudiation | The signer cannot later deny signing the document, making DSCs critical for contracts, tenders, and statutory filings |
| Efficiency | Enables secure filing and document signing 24×7 from any location without printing, scanning, or couriering physical documents |
| Single DSC, multiple portals | One Class 3 DSC can be used across GST, MCA21, Income Tax, GeM, DGFT, EPFO, ICEGATE, and other government platforms |
5 Compliance Points to Remember
- DSC-signed documents are court-admissible. Under the Bharatiya Sakshya Adhiniyam, 2023, electronic records signed with a valid DSC are valid evidence in judicial proceedings.
- Renew before expiry. An expired DSC will cause GST, ITR, and MCA filings to be rejected. Renew at least 30 days before the expiry date.
- You can hold more than one DSC simultaneously. Directors often maintain separate individual and organisational DSCs. There is no restriction.
- Check your USB token’s compliance standard. The CCA issued a 2025 advisory on migration from FIPS 140-2 to FIPS 140-3. If your CA says your token needs replacement, act promptly.
- Report a lost token immediately. Contact your issuing CA to revoke the DSC. Delay increases your legal and financial exposure.
