Digital Signature Certificate (DSC): Classes, Uses, Cost, Validity
A plain guide to buying and using a DSC in India: the current Class 3 rules, where you need it, the USB token, validity, renewal and indicative cost.
A Digital Signature Certificate (DSC) is the electronic equivalent of your signature and stamp for government portals in India. This guide explains which class you need today, where you will use it (MCA, GST, income tax, e-tenders, DGFT), how to buy one online in about an hour, what the USB token is, how long it lasts and what it typically costs, so you do not end up paying for the wrong certificate.
Key Takeaways
- For individuals, Certifying Authorities now issue Class 3 signing certificates; under the CCA’s identity verification guidelines they no longer issue Class 2 individual signing certificates on their own.
- Most small businesses need a Class 3 “signing” DSC; e-tenders usually also need an “encryption” certificate, sold together as a combo.
- The private key must be generated on a FIPS-validated hardware crypto token, which is why every DSC comes on a USB token.
- You can buy a DSC online from any CCA-licensed Certifying Authority or its partners, with Aadhaar eKYC or video verification.
- Validity options are typically 1, 2 or 3 years; prices are set by each CA and vary, so compare before buying.
What a DSC is and who regulates it
A DSC is an electronic certificate, issued under the Information Technology Act, 2000, that binds your identity to a cryptographic key pair. When you sign a form on the MCA or GST portal, your private key (stored on the token) creates a signature that anyone can verify using your public certificate.
The Controller of Certifying Authorities (CCA) under the Ministry of Electronics and IT licenses and supervises the Certifying Authorities (CAs). CCA itself does not sell DSCs to the public; it issues certificates only to CAs, and the CAs (and their registration partners) issue DSCs to individuals and organisations. The CCA website lists the currently licensed Certifying Authorities with their contact details.
DSC classes today: what changed and what to buy
Older articles still describe Class 1, Class 2 and Class 3 certificates as separate products for different uses. That is out of date for individual signing certificates. The CCA’s current Identity Verification Guidelines say a CA shall issue Class 3 individual signing certificates (personal and organisational) carrying both the Class 2 and Class 3 identifiers, and shall not issue Class 2 individual signing certificates alone. In practice, a Class 3 certificate is accepted wherever a Class 2 certificate used to be required.
| Type | What it is | Who typically needs it |
|---|---|---|
| Class 3 Individual (Personal) | Signing certificate in an individual’s own name | Proprietors, directors, professionals, individuals filing on government portals |
| Class 3 Individual (Organisational) | Signing certificate that also carries the organisation’s name, verified with organisation documents | Employees or signatories who sign on behalf of a company, e.g. for tenders |
| Signing + Encryption combo | A signing certificate plus an encryption certificate | Bidders on e-procurement portals, where bids are encrypted |
| DGFT certificate | Class 3 certificate suited to DGFT applications | Importers and exporters signing DGFT applications |
| Document Signer | Organisation-level certificate for automated, high-volume signing of documents such as invoices | Banks, large companies, platforms issuing signed documents |
If a vendor still offers you a “Class 2” DSC for a lower price, ask exactly what certificate will be issued. Under the current guidelines it should be a Class 3 certificate.
Where small businesses use a DSC
| Portal or use | Is a DSC needed? |
|---|---|
| MCA (company incorporation, annual filings, director forms) | Yes, for directors and professionals signing e-forms; directors usually need one before incorporation |
| GST portal | Mandatory for companies and LLPs to sign returns and applications; proprietors and partnerships can use EVC (OTP) instead |
| Income Tax e-filing | Mandatory for companies and for signing tax audit reports, and required for some other audited taxpayers; most individuals can e-verify with Aadhaar OTP or net banking |
| Government e-tenders (CPPP, state e-procurement, GeM bidding) | Usually a Class 3 signing plus encryption DSC for bid submission; check each portal’s requirement |
| DGFT (IEC and other applications) | A DSC or Aadhaar e-sign is accepted for signing many applications |
| EPFO employer portal | Authorised signatories register a DSC for approving certain employee requests |
| Signing PDFs, contracts and invoices | Optional; a DSC creates a legally valid electronic signature under the IT Act |
The USB token: why you need one and what to check
CCA guidelines require the private key for a Class 3 individual signing certificate to be generated on a FIPS-validated hardware cryptographic module, which for most users means a USB crypto token. The key never leaves the token, so even if someone copies files from your laptop, they cannot sign as you without the physical token and its PIN.
A few points that save hassle:
- Buy a compatible token. CAs publish lists of supported tokens. In 2026 the CCA issued notices on moving from FIPS 140-2 to FIPS 140-3 validated devices and on SHA-2 compatibility, so a very old token from years ago may not be accepted for a new certificate.
- Install the right driver. Each token brand needs its own driver, and portals such as GST and MCA need a separate signing utility (such as the emSigner utility on GST) running on your computer.
- Do not lose the PIN. CA guidelines do not allow a simple PIN reset; the token has to be re-initialised, which wipes the certificate. CAs must re-issue the certificate free at least once for the remaining validity after authentication; further re-issues may be charged.
- One token, many certificates. A single token can usually hold certificates for more than one person, but each person should keep control of their own PIN. Sharing a director’s token and PIN with staff is a common, risky habit.
How to buy a DSC online: step by step
- Decide the type. Class 3 individual for most filings; signing plus encryption if you bid on tenders; organisational if you sign for a company and the portal asks for it.
- Choose a licensed CA or its authorised partner. Compare price, validity, token cost, and support hours.
- Fill the online application with name, mobile, email, PAN and address. For organisational certificates, upload the organisation’s documents and an authorisation letter.
- Complete identity verification. CCA guidelines allow verification through online Aadhaar eKYC (including biometric), PAN-based or banking eKYC depending on the CA, and online interactive video verification. On a video call you show your face and original documents.
- Verify email and mobile with OTPs.
- Pay online. You receive approval once the CA’s checks are complete, often the same day.
- Download the certificate to the token. Plug in the token, install the driver, log in to the CA’s download page and generate the key pair on the token. The certificate is written to the token; set a strong PIN.
- Register the DSC on each portal where you will use it (GST, MCA, income tax, DGFT, tender portals). Each portal has a “Register DSC” or “Update DSC” option.
A worked example
For example, two co-founders in Ahmedabad setting up a private limited company would each buy a Class 3 individual DSC with 2-year validity, verify through Aadhaar eKYC and a short video call, download the certificates onto their own tokens the same evening, and use them to sign the incorporation forms on the MCA portal. Once the company had a GSTIN, one founder, as authorised signatory, would register his DSC on the GST portal to file returns. If the company later started bidding for government contracts, they would add a signing plus encryption certificate for tender portals.
DSC validity, renewal and cost
Validity and renewal
- Most CAs sell DSCs with 1, 2 or 3-year validity. The CCA’s certificate policy sets a maximum of 3 years for a human subscriber’s signing certificate.
- Renewal is effectively a fresh purchase with re-verification; the old certificate is not extended.
- CCA guidelines cap the validity of an eKYC account with a CA at 2 years, after which identity has to be refreshed.
- After renewal, re-register the new DSC on every portal. Many people renew and then wonder why GST signing fails: the old certificate is still registered.
- Keep a note of expiry dates for every director and signatory. A DSC expiring the week before an annual MCA filing deadline is a common and avoidable panic.
What you will typically pay
There is no single government price. Each CA and reseller sets its own, and prices change. The ranges below are indicative from CA and reseller listings and are not quotes.
| Item | Indicative range | Notes |
|---|---|---|
| Class 3 individual signing, 1 year | Around Rs 1,000 to Rs 2,000 | Often cheaper per year when you take 2 or 3 years |
| Class 3 individual signing, 2 years | Around Rs 1,300 to Rs 2,500 | The most popular choice for directors |
| Signing + encryption combo, 2 years | Around Rs 2,500 to Rs 5,000 | Needed for most e-tendering |
| USB token (FIPS validated) | Around Rs 400 to Rs 1,000 | Sometimes bundled; reuse your token if compatible |
| Organisational / DGFT certificates | Usually higher than personal | Extra document checks |
GST is generally charged on top. Compare the final price including token and tax, not only the headline number.
DSC vs eSign vs EVC: when you do not need a token
| Method | How it works | Good for |
|---|---|---|
| DSC on USB token | Private key on a hardware token; you sign with the token and PIN | Companies and LLPs, frequent filings, tenders |
| Aadhaar eSign | One-time signature through an eSign service provider after Aadhaar OTP authentication | Occasional signing of documents and some applications that accept eSign |
| EVC (electronic verification code) | OTP to the registered mobile or email | GST returns of proprietors and partnerships, income tax returns of individuals not under audit |
If you are a proprietor who files only GST and income tax returns, you may not need a DSC at all. Buy one when a portal requires it, or when you will sign documents often enough to justify it.
Security and common mistakes
- Never hand your token and PIN to an agent or staff member for “just this filing”. Anything signed with it is legally your signature.
- Do not leave the token plugged into a shared computer.
- Buy only from a licensed CA or its authorised partner; check the CA name on the CCA list.
- Do not lose the token. If you do, ask the CA to revoke the certificate immediately.
- Check the name on the certificate exactly matches PAN; mismatches cause rejections on GST and MCA.
- Keep the token driver and portal signing utility updated, especially after a browser or Windows update.
Frequently Asked Questions
Is Class 2 DSC still available?
Not as a separate individual signing certificate. Under the CCA’s identity verification guidelines, CAs issue Class 3 individual signing certificates that also carry the Class 2 identifier, so they work wherever a Class 2 certificate was required.
Can I use one DSC for GST, MCA and income tax?
Yes. A Class 3 individual signing DSC can be registered on all these portals. You register it separately on each portal, and again after every renewal.
How long does it take to get a DSC?
With Aadhaar eKYC or video verification and documents ready, many CAs issue a DSC within a few hours, often the same day. Organisational certificates can take longer because the organisation’s documents are checked.
What happens if I forget my token PIN?
The token has to be re-initialised, which erases the certificate. Under CCA guidelines, the CA re-issues the certificate for the remaining validity free at least once after authenticating you; additional re-issues may be charged.
Do I need a DSC to file my personal income tax return?
Usually not. Individuals not under tax audit can e-verify with Aadhaar OTP, net banking or other modes. A DSC is mandatory mainly for companies, and for signing tax audit reports; check the current e-filing rules for your case.
Is a DSC legally valid for signing contracts?
Yes. A DSC issued by a licensed CA creates an electronic signature recognised under the Information Technology Act, 2000, subject to the exceptions listed in that Act for certain documents. For important contracts, take legal advice on format and stamping.
Buy once, register everywhere, track the expiry
For most founders and small businesses the answer is simple: a Class 3 individual signing DSC on a compatible USB token, with two or three years’ validity, from a licensed CA. Add encryption if you bid on tenders. Register it on every portal you use, keep the PIN to yourself and diarise the renewal. Rules and token standards change, so check the CCA website or your CA before buying. If your company is about to announce incorporation or a funding round, our guides on writing a press release in India and why press releases get rejected are a useful next read.
