What Is a Digital Signature Certificate?
A Digital Signature Certificate is a small file, usually stored on a USB crypto token, that contains your name, email, a public key, the name of the Certifying Authority that issued it, and a validity period. It works on public key cryptography: the certificate is paired with a private key that only you hold, and every time you sign a document, the software uses that private key to create a unique digital fingerprint of the file. Anyone can then use your public key to confirm two things - that the signature really came from you, and that the document hasn't been changed since you signed it.
This is different from typing your name at the end of an email or pasting a scanned signature image into a PDF. Those are electronic signatures, and while they carry some legal weight in India, they don't prove identity or tamper-proofing the way a DSC does. A DSC is issued only after your identity has been verified by a licensed Certifying Authority, and any edit to a digitally signed document after signing breaks the signature instantly - exactly why government portals insist on it for filings that carry legal consequences.
Issuance Time
Hours to 2 working days
Cost
₹800 to ₹4,500 (validity-dependent)
Storage
Mandatory USB crypto token
Why Is a DSC Required in the First Place?
Government systems in India moved almost entirely to online filing over the last decade - company incorporation and ROC returns on the MCA portal, GST returns and registration, income tax e-filing, DGFT import-export applications, e-tendering, and GeM procurement. None of these systems can rely on a scanned wet signature, since there's no way to verify who actually signed or whether the document was altered afterward. A DSC solves both problems at once, which is why it's become mandatory rather than optional across most of these platforms.
What's the Difference Between a Digital Signature and a DSC?
A digital signature is the cryptographic act of signing - the mathematical process that stamps a document with your private key. A Digital Signature Certificate is the credential that makes that signature meaningful to anyone else, because it ties the key pair to a verified identity and is vouched for by a licensed Certifying Authority. You need the certificate to produce a signature that a government portal or a court will actually trust.
Is a Digital Signature Legally Valid in India?
Yes. Section 3 of the Information Technology Act, 2000 gives digital signatures based on asymmetric cryptography the same legal standing as a handwritten signature, and Section 5 extends this recognition to electronic records generally. In practice, a document signed with a valid DSC is treated at par with a physically signed paper document in courts and before regulatory authorities, provided the certificate was issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA), which functions under the Ministry of Electronics and Information Technology.
A digital signature's validity is judged at the moment it was affixed, not at the moment someone later checks it. So if your DSC was valid when you signed a document, that signature stays legally binding even after the certificate itself expires. Signatures made with an expired or revoked certificate, on the other hand, are not valid.
Who Needs a Digital Signature Certificate?
Almost anyone who deals with company law filings, tax filings, or government procurement in India needs one at some point.
Do Company Directors Need a DSC?
Yes. Every director of a private limited company or public company needs a Class 3 DSC to sign ROC forms, annual returns, and incorporation documents on the MCA21 portal. The DSC has to be registered against the director's DIN (Director Identification Number) before it can be used for MCA filings, and each director signs with their own certificate rather than sharing one.
Does an LLP Require a DSC?
Yes, every designated partner of a Limited Liability Partnership needs a DSC to sign the LLP's incorporation forms, annual filings (Form 8 and Form 11), and any amendments filed with the Registrar of Companies. Since an LLP itself isn't a natural person, its designated partners sign on its behalf using their individual DSCs.
Do Individuals Need a DSC?
Individuals need a DSC less often than businesses do, but it becomes necessary for company directorship, digitally signing income tax returns above certain audit thresholds, participating in e-tenders or e-auctions as an individual bidder, or filing trademark and patent applications. A salaried individual filing a simple ITR usually doesn't need one, since Aadhaar-based e-verification covers that case.
Who Needs a DSC for Government Tenders?
Anyone submitting a bid on a government e-procurement portal - a state e-tendering portal, the Central Public Procurement Portal (CPPP), or GeM (Government e-Marketplace) - needs a Class 3 DSC with signing and, in most cases, encryption capability. The signing certificate authenticates the bid, and the encryption certificate seals the financial bid so it can't be read before the official opening time. Missing this before the deadline is one of the most common reasons genuine bids get rejected on technical grounds.
Is DSC Required for GST and Income Tax Filing?
For companies and LLPs, yes, it's mandatory. GST registration, GST returns, and income tax e-filing for companies and LLPs must be digitally signed using a Class 3 DSC registered against the entity's PAN. Proprietorships and individuals can usually use Aadhaar OTP-based e-verification instead, but a DSC is still accepted and sometimes preferred for its added security.
What Types of Digital Signature Certificate Exist?
India used to have three classes of DSC, but that's changed - a lot of older content online still hasn't caught up.
Are Class 1 and Class 2 DSC still issued? No. Class 1 DSC, which only verified a name against an email address, was phased out for being too weak for official use. Class 2 DSC, the standard for MCA, GST, and Income Tax filings for years, was formally discontinued by the CCA with effect from 1 January 2021. Certifying Authorities stopped issuing new Class 2 certificates from that date, and any already issued simply expired without renewal.
What Is a Class 3 Digital Signature Certificate?
Class 3 DSC is now the only class of digital signature certificate issued in India, offering the highest level of identity verification available. It's the certificate you need for every use case in this guide - MCA and ROC filings, GST, income tax, DGFT, e-tendering, GeM, EPFO, and trademark or patent filing. Because it's the sole option now, the earlier question of "which class do I need" has effectively resolved itself: if you need a DSC at all, you need a Class 3 DSC.
Individual DSC vs Organisation DSC
An Individual DSC is issued in a single person's name and used for that person's own filings, such as an income tax return or a signature as company director. An Organisation DSC is issued in the name of a business entity but still carries the name of an authorised signatory, since a certificate can't be issued to a legal entity without a natural person attached to it. Organisation DSCs typically require additional documents proving the applicant's authority to sign on behalf of the entity, such as a board resolution or an authorisation letter on letterhead.
What Is a DGFT DSC?
A DGFT DSC is a Class 3 DSC issued with a special usage flag that makes it compatible with the Directorate General of Foreign Trade portal. It's required for businesses applying for or amending an Importer Exporter Code (IEC), filing under export promotion schemes like Advance Authorisation or EPCG, or submitting other documents through the DGFT system. Most Certifying Authorities issue it as a signing-plus-encryption combo certificate, since some DGFT transactions require encrypted submission.
Signing-Only vs Signing-Plus-Encryption (Combo)
A signing-only DSC is enough for most MCA, GST, and income tax filings, where the only requirement is proving who signed the document. A signing-plus-encryption combo certificate is required wherever a document needs to stay confidential until a set time - exactly the situation with e-tendering (your financial bid shouldn't be readable before the tender opens) and DGFT filings. If you're not sure which one your specific portal needs, check that portal's DSC requirement page before buying, since paying for encryption you don't need adds unnecessary cost.
Where Is a Digital Signature Certificate Actually Used?
This is the part most DSC guides gloss over, so here's the fuller picture.
MCA and ROC filings - incorporation forms, annual returns, charge documents, and change in directors or registered office
GST registration and returns - must be registered on the GST portal against the entity's PAN before it accepts the signature
Income tax e-filing - mandatory for companies, and individuals whose accounts are audited, rather than Aadhaar OTP verification
E-tendering and e-procurement - signing the technical bid and encrypting the financial bid on state, CPPP and other portals
GeM (Government e-Marketplace) - needed to complete seller registration and sign transaction documents
DGFT and import-export - needed for an IEC application or filings under DGFT's export promotion schemes, usually the combo variant
Trademark and patent filing - applications on the IP India portal need to be digitally signed by the applicant or authorised agent
EPFO - employers filing electronic challan-cum-return (ECR) and other compliance documents need a registered DSC
If your business touches more than one of these systems, a single Class 3 DSC can usually be registered and used across MCA, GST, Income Tax, and several other portals, as long as the same PAN is linked everywhere. You don't need a separate certificate for each portal unless it has a specific format requirement, like DGFT does.
How Much Does a Digital Signature Certificate Cost in India?
DSC pricing isn't fixed by the government. Each licensed Certifying Authority sets its own rates, and resellers and Registration Authority partners add their own service charges on top - which is why you'll see very different numbers across websites for what looks like the same certificate.
| Certificate Type |
Typical Price (1–2 yr, GST incl.) |
| Class 3 Individual, signing only |
₹800 – ₹1,700 |
| Class 3 Individual, signing + encryption (combo) |
₹1,600 – ₹3,400 |
| Class 3 Organisation |
₹1,500 – ₹4,000+ |
| DGFT DSC (Organisation, combo) |
₹2,000 – ₹3,500 |
| USB crypto token (if not bundled) |
₹500 – ₹800 |
These are indicative ranges pulled from published pricing pages, not fixed rates, and they change with validity period, whether a token is bundled, and which CA issues the certificate. Always check the final price, including the token and GST, before paying.
Does the Price Include the USB Token?
Sometimes, sometimes not. Many providers bundle a FIPS-certified USB crypto token into the package, while others price the certificate and the token separately and let you skip the token cost if you already have a compatible one from a previous DSC. Since the token stores your private key in tamper-resistant hardware, the CCA mandates it for Class 3 certificates, so you can't get a fully valid DSC without one somewhere in the process.
What Factors Affect DSC Price?
Validity period is the biggest factor - a 3-year certificate costs more upfront than a 1-year one, though it works out cheaper per year. Signing-plus-encryption combo certificates cost roughly double a signing-only certificate, since you're effectively getting two certificates. Organisation DSCs usually cost more than Individual ones because of the extra document verification involved, and whether you buy through a Certifying Authority directly, a reseller, or a full-service Registration Authority partner changes the final price too.
How Long Is a DSC Valid, and How Do You Renew It?
How Long Does a Class 3 DSC Last?
Under current CCA practice, licensed Certifying Authorities can issue Class 3 DSCs with a validity of 1, 2, or 3 years from the date of issuance, chosen by the applicant at purchase. A longer validity costs more upfront but saves the hassle and cost of renewing every year, which matters if you sign documents regularly through the year on MCA or GST portals.
What Happens When a DSC Expires?
An expired DSC simply stops working for signing. You can't use it to sign new documents or log into portals that require a valid certificate, and most portals show an error immediately if you try. Anything you signed before expiry, however, stays legally valid, since validity is checked at the time of signing, not afterward.
When Should You Renew?
Start the renewal process two to three weeks before your existing DSC expires. This gives you enough buffer if verification takes longer than expected, and avoids a gap where you can't sign urgent filings, like a GST return or an MCA form with a statutory deadline. Renewal follows nearly the same process as a fresh application - fresh eKYC or video KYC, payment, and download onto your existing or a new token - and the CCA's Identity Verification Guidelines require fresh KYC at every renewal, with no pass just because the old certificate was already verified once.
Can an expired DSC be renewed? Once a certificate expires, most Certifying Authorities treat the next application as a new certificate rather than a renewal, since the old one is no longer valid and the private key typically needs regenerating. The process is nearly identical either way, but it's worth applying before expiry if you want it to count as a renewal.
What Is a DSC USB Token, and Do You Always Need One?
A DSC USB token is a small hardware device, similar to a USB drive, that stores your private key inside a secure chip rather than on your computer's hard drive. The CCA mandates hardware-based storage validated to FIPS 140-2 (and now transitioning to FIPS 140-3) for Class 3 certificates specifically, because software-only storage on a laptop is far easier to copy or compromise. For Class 3 DSC, a token is required without exception - the certificate can't be legally issued without hardware key storage.
Can you reuse an old token?
Usually yes, as long as it's still functional and supported by the new Certifying Authority's software. Most providers let you download a renewed or new certificate onto an existing compatible token instead of buying another one.
Token lost or damaged?
Report it to your Certifying Authority immediately so they can revoke the certificate on it. A lost token with an active certificate is a genuine security risk until revoked; after that, you'll need a fresh DSC on a new token.