Digital Signature Certificate (DSC) Online in India

A certificate issued by a licensed Certifying Authority under Section 35 of the IT Act, 2000 that links a person to a key pair. You sign with the private key on your token; anyone can verify the signature with the public key in the certificate (Section 3). It is the electronic equivalent of your handwritten signature on a filing.

Yes. Where any law requires a document to be signed, an electronic signature affixed in the prescribed manner satisfies it (Section 5), and a contract is not unenforceable only because it was made electronically (Section 10A). A signature made with a private key under your exclusive control is a secure electronic signature (Section 15).

Class 3. A personal signing certificate on a token is issued as Class 3 and carries the Class 2 identifier too, so it qualifies where a portal asks for either (Identity Verification Guidelines v2.6, clause 1.13(1)). MCA Rule 8(4) and the GST portal still speak of Class 2 or Class 3; a Class 3 certificate meets both.

A Certifying Authority licensed by the Controller of Certifying Authorities under Sections 21 and 24 of the IT Act, 2000. On 26 October 2026 the CCA website listed 23 licensed Certifying Authorities, 14 of them issuing to the public, among them eMudhra, (n)Code Solutions, Capricorn and Protean. The Controller supervises them and sets their standards (Section 18).

A DSC is a certificate you hold for up to three years, with the private key on your token. Aadhaar eSign creates a one-time key and certificate, valid for at most 30 minutes, for each document after an Aadhaar OTP (Section 3A and the Second Schedule). MCA e-forms, company tax returns and GST filings of companies and LLPs need a DSC.

A certificate always names a person. An organisational certificate carries both your name and the name of the business you sign for, once the business authorises you. Special-purpose certificates, such as a document signer used by software, are also issued only to organisational persons (Identity Verification Guidelines, clause 1.19(2)).

An Indian national needs a PAN, Aadhaar or a government ID with the address, a photograph, and a personal mobile number and email ID. A foreign national needs a scanned passport or other photo ID and an address proof, with the originals shown in the video. An organisational certificate also needs the business’s authorisation and proof that it exists.

In most cases, yes. The CCA’s Identity Verification Guidelines (v2.6, 16 June 2026) require an interactive video of at least 20 seconds, in which you say you are applying for a DSC and read out random numbers, recorded within two days before each certificate. Aadhaar biometric authentication can replace it, and banking e-KYC does not need it.

No. The Certifying Authority’s interface accepts details only from the applicant, and a power of attorney is not allowed (Identity Verification Guidelines, clauses 1.2(4) and 1.3(3)). Misrepresenting facts to a Certifying Authority is punishable with up to two years’ imprisonment, a fine of up to ₹1 lakh, or both (Section 71).

Yes. A foreign director or partner applies with a scanned passport or other photo ID and an address proof, and records the video online from abroad, showing the originals (clause 2.6). The CCA guidelines do not require apostille or embassy attestation, though a Certifying Authority may ask for more documents. The token is couriered to you.

You give either a PAN or an Aadhaar number (clause 1.4(2)). The GST portal and DGFT accept only PAN-based certificates, so we apply with your PAN. The Certifying Authority checks it with the Income Tax database, and the certificate carries the name exactly as the PAN shows it.

Usually the same working day once your documents are ready and the video is approved; the certificate then downloads to your token. A foreign national’s application takes longer, and a new token sent by courier takes one to five days.

Up to three years. The X.509 Certificate Policy for India PKI (v1.10, section 5.6) sets three years as the longest life of a personal signing key and certificate, and Certifying Authorities sell one, two and three-year certificates within it. An expired certificate cannot sign, so apply for the next one a week or two before expiry.

A renewal is in practice a fresh issue: your e-KYC account with the Certifying Authority must be valid (it lasts up to two years) and you record a fresh video within two days of issue. A FIPS 140-2 token cannot take a new certificate after 21 September 2026, so a renewal on an older token also means a new FIPS 140-3 token. Register the new certificate on each portal again.

The Certifying Authority will not reset the PIN unless the token is re-initialised, which wipes the key. It then re-issues the certificate for the remaining validity, free of cost at least once per certificate, after authenticating you (Identity Verification Guidelines, clause 1.13(3)(a)).

Ask the Certifying Authority to revoke the certificate; Section 38(1)(a) allows revocation on the subscriber’s request. Section 42(2) requires you to report a compromised key without delay, and you remain liable until you do. Then apply for a new certificate.

No. The Certifying Authority certifies that the information in the certificate is accurate when it issues it (Section 36(e)). After a change of name, mobile or email it carries out a fresh enrolment and issues a new certificate.

Section 42 makes you responsible for keeping control of the private key, and anything signed with it is treated as signed by you. If a professional files for you, keep the PIN yourself, or be present when the filing is signed.

MCA e-forms of companies and LLPs, GST filings of companies and LLPs (the GST portal makes it compulsory), the income-tax return of a company (Rule 164(12), Income-tax Rules, 2026), DGFT applications (or Aadhaar e-sign) and bids on the Central Public Procurement Portal. Professionals certifying MCA forms and tax audit reports use their own DSC.

Yes. A personal certificate is issued to you, so a director of several companies signs for all of them, and for personal filings, with the same DSC. An organisational certificate is different: it names one business and is used for that business.

Log in to your MCA business-user account, open FO Services, choose Associate DSC, insert the token and sign. The V3 portal needs this even if the DSC was registered on the old V2 portal. We do it for you as the last step.

Usually the token driver or the portal’s signing utility is missing or outdated, or the certificate is not yet registered on that portal. Check that the certificate has not expired, install the current driver and signer, and register the DSC again.

No. The price is the Certifying Authority’s charge for the certificate, the USB token and the service fee, with GST at 18%. Section 35(2) lets the Central Government prescribe the application fee paid to the Certifying Authority, up to a ceiling of ₹25,000.