Digital Signature Certificates: Class 3, Validity, and Where You Need One
A Digital Signature Certificate (DSC) is a secure digital key that verifies the identity of the signer. Under the Information Technology Act, 2000, a document signed with a valid DSC has the same legal recognition as a document signed by hand.
Types of DSC
Since 1 January 2021, the Controller of Certifying Authorities has discontinued Class 2 certificates. Class 3 is now the standard for individuals and organisations.
| Type | Use |
|---|---|
| Class 3 – Signing | MCA, income tax, GST, EPFO and general document signing |
| Class 3 – Signing + Encryption | E-tenders and e-procurement portals, where bids are encrypted |
| DGFT DSC | IEC and other DGFT applications |
| Organisation DSC | Issued to an individual on behalf of an organisation, with the organisation's name in the certificate |
A DSC is usually issued for one, two or three years.
How a DSC is issued
DSCs are issued by Certifying Authorities licensed by the CCA. The process involves:
- an online application with ID and address proof. Aadhaar e-KYC or PAN-based verification is common
- video verification, in which the applicant reads a displayed code on camera
- mobile and email OTP verification
- download of the certificate onto a FIPS-compliant USB token, which is required for most portals
The private key is generated and stored on the token, and only the holder should control it. Never share your token and PIN. Anything signed with your DSC is legally attributed to you.
Where you need a DSC
- MCA – all e-forms are signed by directors, and certified by professionals where required
- Income tax – returns of companies, and of taxpayers whose accounts are audited, must be verified with DSC. Others may use Aadhaar OTP or EVC
- GST – companies and LLPs must sign returns with DSC. Others may use EVC
- DGFT – IEC and other applications
- E-tenders – government procurement portals, including GeM-linked processes
- EPFO – employer-side approvals
Managing DSCs in a business
- Keep a register of DSCs with the holder, type, issuing authority and expiry date.
- Renew before expiry. An expired DSC cannot be used, and filings near deadlines get stuck.
- Re-register a renewed DSC on each portal. MCA, GST and income tax each need the new certificate to be registered.
- When a director or signatory leaves, revoke their DSC registration from the company's portals.
- Store tokens securely and record who has custody of them.
The information in this article reflects the law as on the date of publication and is for general guidance only.