What Is a Digital Signature Certificate (DSC)? Types, Uses and How to Get One (2026)
A Digital Signature Certificate (DSC) is the electronic equivalent of a handwritten signature and an identity card rolled into one. It lets an individual or an organisation sign documents and forms online in a way that is secure, tamper-evident and legally valid. In India, almost every major government portal now insists on a DSC before you can file, register or bid. If you are incorporating a company, filing GST returns, submitting income tax forms as an auditor, or applying for a government tender, a DSC is no longer optional. This guide explains what a DSC is, the legal framework behind it, the classes and types available in 2026, its most common uses, validity, and the exact steps to obtain one.
What Is a Digital Signature Certificate?
A DSC is a digitally signed electronic credential issued by a licensed Certifying Authority (CA) that binds a person’s or entity’s identity to a pair of cryptographic keys. When you sign a document with your DSC, the signature confirms three things: that the document genuinely came from you (authentication), that it has not been altered after signing (integrity), and that you cannot later deny having signed it (non-repudiation). The certificate itself contains your name, a unique serial number, the issuing CA’s details, your public key and the certificate’s validity period.
Legal Basis: The IT Act, 2000
Digital signatures in India derive their legal force from the Information Technology Act, 2000. The Act recognises electronic signatures as legally equivalent to handwritten signatures and gives them evidentiary value in courts. The Controller of Certifying Authorities (CCA), operating under the Ministry of Electronics and Information Technology, licenses and regulates the Certifying Authorities that actually issue DSCs. Only certificates issued by these CCA-licensed CAs are accepted on government portals, which is why buying a DSC from an authorised source matters.
How a Digital Signature Works
A DSC relies on public key infrastructure (PKI), which uses a mathematically linked pair of keys. Your private key stays secret and is used to create the signature; your public key, embedded in the certificate, lets anyone verify that signature. When you sign, software creates a unique fingerprint (a hash) of the document and encrypts it with your private key. Anyone can then use your public key to confirm the fingerprint matches, proving the file is authentic and unchanged.
To keep the private key safe, certificates are stored on a secure hardware device rather than a computer’s hard drive. Individuals typically use a USB crypto token (such as ePass, Proxkey or WD), from which the key can never be exported. Organisations handling bulk or automated signing may instead use a Hardware Security Module (HSM), a high-grade device that stores keys and performs signing at scale.
Classes of DSC: Why Class 3 Is Now the Standard
Historically, DSCs came in Class 1, Class 2 and Class 3. Following CCA guidelines, Class 2 certificates were discontinued and Class 3 is now the single standard for virtually all statutory and commercial filings. Class 3 involves stronger identity verification and is mandatory for the Ministry of Corporate Affairs (MCA) filings, GST, income tax e-filing, e-tenders and e-procurement. Class 1 certificates, which only confirmed an email identity, are effectively obsolete for business use.
| Class | Status in 2026 | Typical Use |
|---|---|---|
| Class 1 | Largely obsolete | Basic email identity only |
| Class 2 | Discontinued | Formerly used for MCA and tax filings |
| Class 3 | Current standard | MCA, GST, ITR, e-tenders, trademark, all filings |
Types of DSC: Sign Only vs Sign Plus Encrypt
Within Class 3, DSCs are offered in two functional types depending on what you need to do:
- Sign only: Used purely to sign documents and forms, confirming authenticity and integrity. This is sufficient for MCA filings, GST, income tax and most routine submissions.
- Sign plus Encrypt (Combo): Includes a separate encryption certificate in addition to the signing certificate. It is required where confidential data must be encrypted, most commonly in e-tenders and e-procurement portals where bid documents need protection.
Common Uses of a DSC in India
A single Class 3 DSC unlocks a wide range of online services. The most common uses include:
- Company and LLP work: Incorporation and all MCA filings, including forms filed on the MCA21 portal by directors and professionals.
- GST: Registration and filing of GST returns, mandatory with a DSC for companies and LLPs.
- Income tax e-filing: Filing returns and audit reports, especially for companies, LLPs and taxpayers subject to audit.
- EPFO: Employer filings and authorised signatory registration on the EPFO portal.
- E-tenders and e-procurement: Submitting and encrypting bids on government tender portals.
- Trademark and IP: Filing trademark, patent and design applications online.
- Other filings: Import-export (DGFT), customs, provident fund and various regulatory submissions.
If you are unsure which class or type suits your requirement, TAXAJ’s Digital Signature Certificate service can assess your filing needs and arrange the right certificate end to end.
Validity Period
A DSC is issued for a fixed term, usually one, two or three years. Once it expires, you cannot use it to sign and must obtain a fresh certificate; renewal is essentially a re-issue. The USB token itself is reusable, so on renewal you can often load the new certificate onto your existing token. It is good practice to track expiry dates, since a lapsed DSC can hold up time-sensitive filings.
How to Apply for a DSC
DSCs are issued only through CCA-licensed Certifying Authorities such as eMudhra, Capricorn, Pantasign, VSign and others, usually via their registered partners. The modern process is almost entirely paperless thanks to video and Aadhaar-based eKYC. The typical steps are:
- Choose the certificate: Select Class 3, decide between Sign only or Sign plus Encrypt, and pick the validity period.
- Submit the application: Fill in the applicant details on the CA’s portal and upload the required documents.
- Complete eKYC: Verify identity through Aadhaar-based paperless KYC or PAN-based KYC, followed by a short mobile OTP and email verification.
- Video verification: Record a brief video reading a one-time code, as mandated by CCA norms, to confirm you are a live applicant.
- Download to token: Once approved, the certificate is downloaded and stored on your USB crypto token, ready for use.
Documents Required
For an individual DSC you generally need PAN, Aadhaar or another accepted address proof, a passport-size photo, and an active mobile number and email linked for verification. For an organisation DSC, additional documents such as the authorisation letter, company PAN, incorporation certificate and the authorised signatory’s identity proof are required. Foreign nationals must provide notarised and apostilled documents.
Frequently Asked Questions
Is a DSC mandatory for filing income tax returns?
Not for every taxpayer. Individuals can often file using an Aadhaar OTP or electronic verification code. However, companies, LLPs and taxpayers liable to audit must use a DSC to file their returns and audit reports.
Can one DSC be used on multiple portals?
Yes. A single Class 3 DSC issued in your name can be used across MCA, GST, income tax, EPFO and tender portals, provided your identity is registered as an authorised signatory on each portal.
What is the difference between Sign only and Sign plus Encrypt?
A Sign only DSC signs documents to prove authenticity, which covers most filings. A Sign plus Encrypt DSC adds an encryption certificate for confidentiality and is needed mainly for e-tender and e-procurement portals.
How long does it take to get a DSC?
With Aadhaar-based eKYC and video verification, a DSC can often be issued the same day or within one to two working days, once documents and verification are complete.
What happens when my DSC expires?
An expired DSC cannot be used for signing. You must apply afresh (a renewal is technically a re-issue) and can usually load the new certificate onto your existing USB token.
