Digital Signature Certificate (DSC)

Who can use this

• Indian citizens and NRIs
• Companies and LLPs
• Partnerships and HUFs
• Government officials
• Professionals (CAs, lawyers, engineers)
• Businesses requiring digital signing (MCA filings, e-tendering, GST forms)

Who cannot use this

• Minors (below 18 years)
• Persons with criminal convictions
• Non-citizens without valid documentation

Documents required

• PAN card (original + copy)
• Aadhaar card (original + copy)
• Address proof: electricity bill, water bill, telephone bill, or lease deed (not older than 3 months)
• Identity proof: PAN, Aadhaar, Passport, or Driving License
• 2-3 color photographs (passport size, 35x45mm, white background)
• Specimen signature on CA form
• Proof of business registration (if applying for company: Certificate of Incorporation)

Step-by-step process

1. Choose a licensed Certifying Authority (CA) — Select from licensed CAs in India: eMudhra, Mahindra WebSign, nCode, CCA, SafeScrypt, Indian CA, or others. Check CA website for DSC services, pricing, and office locations.
2. Visit CA office or online portal to apply — Visit selected CA's office with original documents or log in to their online portal (e.g., eMudhra.com, WebSign.in) to start DSC application process.
3. Fill DSC application form (online or offline) — Complete the DSC application form: name, PAN, Aadhaar, date of birth, address, email, mobile number, purpose (business/legal/finance). Select DSC type: USB token or software.
4. Upload identity and address proof documents — Scan and upload: PAN card, Aadhaar card, address proof (utility bill, lease deed), and 2 color photographs. Files should be clear JPEG/PDF (max 2MB each).
5. Pay DSC application and issuance fee — Pay fee to the CA: ₹500-1,500 (depending on CA and DSC type). USB token DSC costs more (₹800-1,200) than software DSC (₹400-800). Pay online or at CA office.
6. Schedule video KYC appointment — CA will assign a video KYC slot. Schedule appointment for video verification with CA. Ensure good internet, webcam access, and quiet environment. Receive appointment confirmation email.
7. Complete video KYC with CA official — Attend video KYC at scheduled time. CA official will verify your identity (compare PAN/Aadhaar with your face), ask security questions, and confirm details. Must be in live video call.
8. CA verifies documents and approves application — After video KYC, CA validates all submitted documents. Verification usually takes 24-48 hours. CA will email approval confirmation with next steps for token generation or software DSC delivery.
9. Generate and download DSC (software DSC) — If selecting software DSC: CA sends secure link to download DSC file (usually .PFX or .P12 format). Download and save in secure location. Set a strong password to protect the file.
10. Receive and activate USB token (hardware DSC) — If selecting USB token: CA dispatches USB token (usually via courier). Upon receipt, visit CA office to activate token. CA official will register token in your name and set PIN.
11. Test and verify DSC installation — Install DSC reader software (provided by CA). Connect USB token (hardware) or import software file. Test DSC: sign a sample document to verify it works correctly before using for official filings.
12. Configure DSC in relevant applications — Set up DSC in applications you'll use: e-Filing (income tax), MCA portal (company filings), GST portal (GST forms), etc. Each application has a DSC configuration section.
13. Use DSC for digital document signing — Now you can digitally sign forms and documents: ITR forms, GST forms, company incorporation forms (SPICe+), appeals, etc. Click 'E-sign' in the portal, select your DSC, and sign.
14. Renew DSC before expiry — DSC validity is typically 1-2 years. Monitor expiry date. 30 days before expiry, apply for renewal with the CA. Renewal costs ₹300-500. Process similar to initial issuance but faster.
15. Maintain DSC security and backup — For software DSC: keep backup copies in secure location (external drive, cloud encrypted storage). For USB token: keep in safe place; do not share PIN. In case of token loss: report to CA immediately and apply for duplicate token.

Class 3 is what statutory filings require

Digital signature certificates are issued by licensed certifying authorities, and Class 3 is the level used for MCA filings, income tax and GST where a DSC is required, e-tendering and customs. Signing certificates and encryption certificates serve different purposes, and combination tokens exist. Buy the class the filing actually needs — a lower-class certificate that cannot be used for tenders is a false economy.

It is personal, and it must not be shared

A DSC identifies an individual, and anything signed with it is legally attributed to that person. Handing the token and PIN to a consultant so they can file conveniently transfers the ability to sign in your name — including documents you have not seen. Keep custody of your own token, and where a professional files on your behalf, sign in their presence or use their own credentials where the law permits.

Validity, renewal and what expiry breaks

Certificates are issued for one to three years and must be renewed before expiry; an expired DSC cannot be used and renewal generally means fresh issuance rather than extension. Expiry is usually discovered at the worst moment — on the day of a filing deadline. Because the cycle sits outside every other compliance calendar, note the expiry date somewhere it will be seen a month in advance.

Registration on the portal is a separate step

Obtaining a DSC is not the same as being able to use it. It must be registered against the relevant role on each portal — as a director or professional on the MCA portal, and against the PAN on the income-tax portal. Where a director's DIN or a professional's membership details do not match the certificate, registration fails. Foreign nationals face additional attestation requirements, which are worth arranging early in an Indian subsidiary incorporation.

If the token is lost, revoke it

A lost or compromised token should be reported to the certifying authority and the certificate revoked, not simply replaced. Until revocation, the certificate remains capable of producing signatures attributable to you. Keep a record of which certifying authority issued it and the certificate details, so revocation can be requested quickly rather than after a search through old emails.

More Licenses & Certifications services

• ISO Certification Registration
• 12A Registration (Tax Exemption)
• 12A & 80G Combined Registration
• FSSAI Registration
• FSSAI License
• Trade License

Related reading

• DPDP Act 2023 Compliance Checklist for Small Business
• Legal Heir Certificate India 2026: Process and Documents