DSC (Digital Signature Certificate)
A DSC (Digital Signature Certificate) is an electronic credential that verifies a signer’s identity in digital filings — used for MCA, GST, ITR and tenders.
A Digital Signature Certificate (DSC) is an electronic form of a signature issued by a licensed Certifying Authority (CA) in India. It cryptographically verifies the identity of the signer and ensures the integrity of the signed document — once a document is digitally signed, any subsequent alteration is detectable. DSCs are legally recognised under the Information Technology Act, 2000 and are mandatory for filing documents on the Ministry of Corporate Affairs (MCA) portal, the GST portal, the Income Tax portal and various government procurement systems.
What a DSC Does
A DSC serves two functions:
- Authentication: Confirms that the signature was made by the person who holds the certificate (linked to their PAN and Aadhaar/KYC)
- Integrity: Ensures the signed document has not been tampered with after signing — the signature becomes invalid if the document is altered
This makes a DSC far more secure than a scanned physical signature, which can be copied or attached to any document without detection.
Classes of DSC
Under the Controller of Certifying Authorities (CCA) regulations, DSCs are classified by the level of identity verification:
Class 1: Basic certificates verified only against the subscriber's email and PAN. Not accepted for most regulatory filings in India. Rarely issued for business purposes now.
Class 2: Verified against PAN, Aadhaar and other government records. This class was discontinued for new issuances in 2021 and replaced by Class 3 for all purposes.
Class 3: The highest assurance level, requiring in-person or video-based identity verification (eKYC using Aadhaar). This is the only class currently issued and accepted for all regulatory and government filings:
- MCA filings (SPICe+, ROC forms, annual returns)
- GST registration and amendments
- Income Tax return filing (mandatory for companies; optional for individuals)
- DGFT filings (IEC applications, export documentation)
- Government e-tendering (GeM, CPPP, state procurement portals)
- EPFO and ESIC filings (in some contexts)
Use Cases by Platform
| Platform | DSC Requirement |
|---|---|
| MCA (company filings) | Mandatory for directors and authorised signatories |
| GST portal | Required for company/LLP GST registration; individuals can use Aadhaar OTP instead |
| Income Tax e-filing | Mandatory for companies (Form ITR-6, ITR-7); optional for individuals |
| DGFT (IEC, FTP applications) | Required |
| GeM / e-procurement | Required for vendor registration |
| ROC (annual returns, charges) | Required |
| EPFO / ESIC | Required in certain employer portal actions |
Validity Period
DSCs are issued with a validity of 1 year or 2 years (most common) or 3 years, depending on the certificate and the certifying authority. After expiry, the DSC must be renewed — signatures made with an expired DSC before its expiry remain valid, but new documents cannot be signed with it.
It is advisable to renew the DSC at least 30 days before expiry, as the renewal process takes a few days and expired DSCs can cause delays in time-sensitive filings.
How to Get a DSC
DSCs are issued by CCA-licensed Certifying Authorities (CAs). As of 2024, the principal licensed CAs in India include:
- eMudhra
- Sify (now part of SafeScrypt)
- Pantasign
- NSDL (Protean eGov)
- CDAC
- (n)Code Solutions
Steps to obtain a Class 3 DSC:
- Choose a Certifying Authority and visit their website or an authorised Registration Authority (RA)
- Fill the application form with personal details — name, designation, organisation, email, PAN
- Complete KYC: Aadhaar-based eKYC (video verification) is the most common method. Some CAs conduct in-person verification
- Attach documents: PAN, Aadhaar, passport-size photograph, authorisation letter (for organisation DSCs)
- Pay the fee (approximately ₹1,000–₹3,000 for a 2-year Class 3 DSC depending on the CA and whether it is individual or organisation type)
- Receive the DSC: Typically issued within 1–3 working days. The DSC may be delivered as a USB token (hardware token that stores the private key) or downloaded for use with specific software
DSC on a USB Token
Most Class 3 DSCs for regulatory filings are issued on a USB token — a small hardware device that stores the private key of the certificate in tamper-proof hardware. The token is plugged into a computer when signing, and a PIN is required to use it. This prevents the private key from being extracted or copied, ensuring that only the physical holder of the token can sign.
To use a DSC token:
- Install the token software provided by the CA
- Plug in the USB token
- When signing a document on the relevant portal (MCA, GST, etc.), select "DSC" as the signing method
- The portal reads the certificate from the token and prompts for the token PIN
- Enter the PIN to authorise the signature
DSC vs OTP e-Signature: Key Difference
| Feature | DSC (Digital Signature Certificate) | OTP / Aadhaar e-Sign |
|---|---|---|
| Legal validity | IT Act, 2000 (Section 3A) | IT Act, 2000 |
| Identity verification | Highest (Class 3 KYC) | Aadhaar-linked mobile OTP |
| Use for MCA filings | Mandatory | Not accepted |
| Use for ITR | Mandatory for companies | Accepted for individuals |
| Validity | 1–3 years (renewable) | Per transaction |
| Hardware required | USB token (usually) | None (mobile) |
Both are legally valid electronic signatures, but they serve different contexts. For regulatory filings on MCA and many other government portals, only a Class 3 DSC is accepted.