Digital signature certificates, explained: Class 3, sign versus encrypt, and who actually needs one
A DSC is the legal equivalent of your signature on a government portal. Since 2021 there is only one class, it lives on a USB token, and it expires on the day you most need it. Here is how it works.
Reviewed by Vijay Dhawan, Managing Partner, LexVerge LLP · Published 14 September 2026
What a DSC is
A digital signature certificate is an electronic credential issued under the Information Technology Act, 2000 by a certifying authority licensed by the Controller of Certifying Authorities. It binds a public key to your identity, so that a document signed with the matching private key is treated as signed by you under section 3 of the Act.
The private key is stored on a hardware USB token that meets the FIPS 140-2 standard, protected by a PIN. Signing means plugging in the token, entering the PIN and letting the portal’s signing utility apply the signature. The certificate itself is public; the token is what you must not lose.
Class 3 is the only class
Class 2 certificates were withdrawn on 1 January 2021. Every DSC issued since is Class 3, which requires identity verification to the highest assurance level and is accepted everywhere a DSC is accepted at all. Old references to Class 2 for MCA or income-tax filing are simply out of date.
Within Class 3 there are three variants and two holder types:
| Variant | What it does | Typical use |
|---|---|---|
| Signature | Signs documents and forms | MCA, income tax, GST, trademark, EPFO, most filings |
| Encryption | Encrypts data so only the holder can read it | Rarely bought alone |
| Combo (sign and encrypt) | Both keys on one token | e-tendering and e-procurement portals, which require encryption |
An individual DSC carries the person’s name and PAN. An organisation DSC carries the person’s name together with the organisation’s details and is what DGFT and many tender portals require for a company. Directors signing MCA forms use individual DSCs; the company itself does not hold one.
Validity, price and the token
Certificates are issued for one, two or three years, chosen at purchase. In 2026 a two-year Class 3 signature certificate costs roughly ₹800 to ₹1,500 from the certifying authorities and their registration partners, a three-year one somewhat more, and the combo variant about ₹1,000 above the signature price. The USB token is usually ₹400 to ₹800 on top unless you already own one.
A DSC cannot be extended. Renewal means a new certificate, which can be loaded onto the existing token if it is still supported. Buy the longest validity you will use: the cost difference is small and expiry always arrives during a filing.
How issuance works in 2026
- Apply with a certifying authority or its registration partner, giving the name exactly as on PAN, the mobile number and the email.
- Complete paperless KYC: PAN and Aadhaar verification by OTP, or an eKYC account with the certifying authority.
- Record the short verification video the authority requires, reading out the application code, with the original identity document visible.
- The certificate is issued, typically within an hour, and downloaded onto the token using the authority’s utility.
Foreign nationals and NRIs apply with a passport and an overseas address proof, attested or apostilled as the authority requires, and the video call replaces in-person verification. A foreign director of an Indian company needs their own DSC to sign incorporation and annual forms.
Which filings insist on a DSC
| Portal | Who must sign with a DSC |
|---|---|
| MCA | Every director and the certifying professional on SPICe+, AOC-4, MGT-7A, DIR-12, DIR-3 KYC and all event-based forms; designated partners on LLP forms |
| Income tax | Companies and any taxpayer subject to tax audit; the CA on audit reports and Form 15CB; political parties and certain others |
| GST | Companies and LLPs on registration and returns; others may use Aadhaar OTP or EVC |
| DGFT | Firms and companies for the IEC and its annual update; licences and scheme claims |
| Trade marks and patents | Applicants and agents filing on the IP India portal |
| EPFO and ESIC | Employer registration and monthly returns in many cases |
| Tenders | Combo certificates on government e-procurement portals |
Before first use on each portal the DSC must be registered there: associated with the DIN on MCA, registered under the profile on the income-tax e-filing site, and linked to the GSTIN on the GST portal. Registration is where most first-day failures happen, not signing.
Where DSCs fail
Name mismatch. The name on the certificate must match the PAN and, on MCA, the DIN record character for character. A missing middle name means the portal rejects the signature.
Expired on the day. Directors who sign nothing between annual filings discover the expiry at the AOC-4 deadline. Check the validity in September, before the filing season.
Utility and driver problems. The MCA and income-tax signing utilities and the token drivers need specific versions; a browser update breaks them. Keep the emSigner or equivalent utility current on the machine you file from.
Wrong holder. An organisation DSC is not a substitute for a director’s individual DSC on MCA forms, and an individual DSC will not satisfy a DGFT company profile.
Lost token. The certificate must be revoked with the authority and reissued; the private key cannot be recovered. Treat the token like a cheque book.
The list of licensed authorities is published by the Controller of Certifying Authorities. Our DSC service issues a Class 3 certificate with the token in about 30 minutes and registers it on the portals you need.
Frequently asked questions
Is a Class 2 DSC still valid?
No new Class 2 certificates have been issued since 1 January 2021 and any issued before then have expired. Class 3 is the only class in use.
How long is a DSC valid?
One, two or three years, chosen at purchase. It cannot be extended; renewal is a new certificate.
Do I need a DSC for GST?
Companies and LLPs must sign GST applications and returns with a DSC. Proprietors, partnerships and individuals can use Aadhaar OTP or an electronic verification code instead.
What is the difference between a signature DSC and a combo DSC?
A signature certificate signs documents. A combo adds an encryption certificate on the same token, which government e-tendering portals require to decrypt bid documents. For MCA, income-tax and GST filing, a signature certificate is enough.
Can a foreign director get a DSC?
Yes, with a passport and an overseas address proof attested as the certifying authority requires, and a video verification. It is required for incorporation and annual MCA filings.
Class 3 DSC in about 30 minutes
Certificate, token and portal registration, from ₹199 plus the certificate cost.
Keep reading.
DIR-3 KYC 2026: the annual deadline is gone. Here is the three-year rule.
The 30 September deadline is gone. What the once-in-three-years rule, the merged form and the 30-day change intimation mean for every DIN holder.
Read guide→GuideIEC Code Explained: Who Needs an Import Export Code, How to Get One, and the Annual Update That Deactivates It
Who needs an Import Export Code, how DGFT issues it for ₹500, and the April-to-June annual update that silently deactivates it.
Read guide→Official references
The statutory sources behind this page. We keep our guidance aligned to them — verify anything time-sensitive directly.
- Ministry of Corporate AffairsCompanies Act filings, forms and fee schedules
- Income Tax DepartmentReturns, forms, rates and e-filing utilities
- GST PortalRegistration, returns and rate notifications
Content on this page is reviewed by a chartered accountant or advocate at LexVerge LLP. It is general guidance, not advice on your specific facts.