All about Digital Signature Certificate

A Digital Signature Certificate is the legal electronic equivalent of a handwritten signature in India, governed by the IT Act, 2000. In 2026, only Class 3 DSCs are accepted across MCA V3, the Income Tax portal, GSTN, ICEGATE, DGFT, and e-Tendering platforms. They are mandatory for company directors, statutory auditors, and GST taxpayers above prescribed thresholds. DSCs are issued by CCA-licensed Certifying Authorities such as eMudhra, Sify and Capricorn after video KYC, stored on a USB cryptographic token, and typically valid for one to three years.

Mayank Wadhera

Published: 3 Aug 2024

Updated: 16 May 2026

4 min read

A Digital Signature Certificate (DSC) is your electronic identity for signing documents on Indian government portals — from MCA V3 and the Income Tax e-filing portal to GSTN, ICEGATE, and DGFT. In 2026, DSCs are mandatory for company directors, GST taxpayers above ₹5 crore turnover, statutory auditors, and anyone filing forms that require legally binding signatures. With cryptographic standards aligned to the IT Act, 2000 and Controller of Certifying Authorities (CCA) guidelines, a valid DSC is non-negotiable for compliance professionals and founders.

What a DSC actually is

A DSC is a cryptographic key pair issued by a CCA-licensed Certifying Authority (CA) such as eMudhra, Sify, Capricorn, or Pantasign. The certificate binds your verified identity to a public-private key pair. When you sign a PDF or XML, the private key — stored on a USB cryptographic token — generates a signature that any verifier can validate against your public key. Under section 5 of the IT Act, a properly issued DSC carries the same legal weight as a handwritten signature.

Classes and current standards

Class 3: the only class accepted by MCA, Income Tax, GST, MCA V3, e-Tendering and ICEGATE since 2021. Issued only after stringent video-based KYC.
DGFT DSC: a specialised Class 3 variant tied to your IEC code for foreign trade filings.
Document Signer Certificate (DSC for organisations): used by companies to bulk-sign invoices and reports.
All current DSCs are cryptographic token-based; soft-token DSCs were phased out for security reasons.

How to obtain a DSC in 2026

Choose a CCA-licensed Certifying Authority and pick a one or two-year validity.
Complete online KYC — PAN, Aadhaar e-KYC or video verification.
Pay the issuance fee (₹800 to ₹2,000 plus token cost of ₹250 to ₹600 if you do not already own one).
Download the certificate onto a FIPS 140-2 Level 2 USB token.
Install the CA's signing utility and register your DSC on each portal where you will use it.

Where DSC is mandatory

DSC is mandatory for all directors, subscribers and authorised signatories filing on MCA V3 — every SPICe+, AOC-4, MGT-7, DIR-3 KYC, INC-22, ADT-1, CHG-1 and similar form requires it. On the Income Tax portal, companies, LLPs and audit-mandated taxpayers must e-verify returns and tax audit reports using DSC. GST taxpayers (companies, LLPs and certain proprietorships) sign GSTR returns with DSC. Tendering on GeM, CPP Portal and railway/NHAI portals also requires Class 3 DSC.

Validity, renewal and revocation

DSCs are typically valid for one, two or three years. Renew at least 15 days before expiry to avoid filing disruptions. Notify the CA immediately if your token is lost or compromised — the CA must revoke the DSC and publish it on the Certificate Revocation List. Using an expired or revoked DSC for filings results in form rejection and potential penalties for delayed compliance.

Practical operational tips for DSC management

Buy a two or three-year DSC to reduce renewal frequency and price per year.
Always physically possess your USB token — never share with consultants or staff.
Maintain a DSC register listing each signatory, validity period, and CA who issued it.
Renew at least 15 days before expiry to avoid filing emergencies.
Use FIPS 140-2 Level 2 certified tokens — older USB drives are no longer accepted.
If a token is lost, immediately notify the issuing Certifying Authority to trigger revocation and prevent misuse.

For organisations with many signatories — say, a Pvt Ltd with multiple directors and a CS — designate one person to centrally track DSC validity and trigger renewals. Filing emergencies due to expired DSCs are amongst the most common operational disruptions in MCA compliance.

DSC for foreign nationals and NRIs

Foreign nationals and NRIs serving as directors of Indian companies also need Class 3 DSCs. The process involves submitting an apostilled application form, apostilled passport copy, apostilled address proof, and a passport-size photograph attested by the Indian Embassy or Consulate. Some Certifying Authorities support a fully online video-KYC process for foreign nationals, completed via Skype or comparable platforms. Allow 7 to 15 working days for issuance and budget ₹3,000 to ₹5,000 per foreign DSC including courier and authentication costs. Foreign directors must also obtain DIN before being added to the board, typically through SPICe+ during incorporation or DIR-3 thereafter.

Conclusion

A Class 3 DSC is the foundation of every digital compliance workflow in India in 2026. Choose a reputed Certifying Authority, secure your USB token, and track validity carefully. A small upfront investment in a multi-year DSC saves you from filing emergencies and last-minute renewal scrambles.

Frequently Asked Questions

Which class of DSC is valid in India in 2026?

Only Class 3 DSCs are accepted by MCA V3, the Income Tax portal, GST, ICEGATE, DGFT and e-Tendering platforms since 2021. Earlier Class 2 DSCs were discontinued. Always procure a Class 3 token for any statutory filing.

How long is a DSC valid?

DSCs are usually valid for one, two or three years. Most founders and professionals choose two-year DSCs to balance cost and renewal frequency. Renew at least 15 days before expiry to avoid filing disruption.

What does a DSC cost?

A Class 3 DSC costs ₹800 to ₹2,000 depending on validity period and the Certifying Authority. The FIPS 140-2 Level 2 USB token is an additional ₹250 to ₹600 if you do not already own one.

Can I share my DSC with my CA?

No. A DSC is a personal cryptographic credential and sharing it is a violation of the IT Act and CCA guidelines. The signatory must affix the DSC personally. CAs can prepare forms; only the director or authorised signatory should sign.