Digital Signature Certificate (DSC) in India 2026

A Digital Signature Certificate (DSC) is an electronic credential used to authenticate the identity of a person signing an electronic document or filing.

For company directors, LLP designated partners, Chartered Accountants, Company Secretaries, Cost Accountants, authorised representatives and many businesses in India, DSC is an essential part of electronic compliance.

It is widely used for:

• MCA company and LLP filings;
• incorporation forms;
• annual ROC filings;
• income-tax and GST-related workflows where digital signing is supported or required;
• Government e-tendering;
• GeM and procurement platforms;
• DGFT-related filings;
• ICEGATE/customs-related processes; and
• other secure electronic transactions.

In 2026, Class 3 DSC is the standard high-assurance certificate commonly purchased for MCA, tendering and professional compliance use. The Controller of Certifying Authorities (CCA) permits Class 3 certificates to be used in applications that require a lower assurance class, subject to application-specific requirements.

A DSC is not issued by the Ministry of Corporate Affairs. It is issued by a Certifying Authority licensed by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology.

This guide explains how DSC works, who needs it, how to apply, current validity options, practical cost, USB-token requirements, MCA V3 association and important security rules.

DSC in India 2026 - Quick Overview

Important: A DSC is personal to the subscriber. Giving the USB token and PIN to another person to sign documents on your behalf defeats the security model and can create serious legal and compliance risk.

What Is a Digital Signature Certificate?

A Digital Signature Certificate is an electronic certificate that links a subscriber's identity with a cryptographic public key.

When the subscriber digitally signs an electronic record:

1. a cryptographic signing operation is performed using the subscriber's private key;
2. the signature is linked to the content being signed; and
3. the recipient or electronic system can verify the signature using the corresponding public-key infrastructure.

A digital signature therefore does more than place an image of a handwritten signature on a PDF.

It helps establish:

• identity of the signer;
• authenticity of the electronic record; and
• whether the signed content has been altered after signing.

The CCA regulates India's public-key infrastructure under the Information Technology framework.

Who Issues DSCs in India?

DSCs are issued by licensed Certifying Authorities (CAs).

The Controller of Certifying Authorities does not normally issue end-user DSCs directly. It licenses and regulates Certifying Authorities, which then issue certificates to individuals and organisations.

As of September 2026, CCA's active public-service list includes licensed CAs such as:

• SafeScrypt;
• nCode;
• eMudhra;
• Capricorn;
• VSign/Verasys;
• PantaSign;
• RISL/RajComp;
• IDSign;
• XtraTrust;
• ProDigiSign;
• SignX; and
• Care4Sign.

The active list can change.

Before buying a DSC, verify that the issuing Certifying Authority is currently listed by the Controller of Certifying Authorities.

Does the Brand of DSC Affect Its Legal Validity?

CCA states that certificates of the same class and type issued by different licensed CAs operate under the common India PKI framework and carry the same assurance level.

The main differences for a user are normally:

• price;
• customer support;
• KYC process;
• token supplied;
• validity package;
• download/reissue support; and
• integration assistance.

Do not assume that a more expensive DSC has a higher legal status merely because of the brand.

What Is a Class 3 DSC?

Class 3 is a higher-assurance class of Digital Signature Certificate under the CCA framework.

For Class 3 certificates, CCA's identity-verification framework permits routes such as:

• Aadhaar eKYC biometric;
• paper-based application and supporting documents together with prescribed personal/video verification; or
• Aadhaar eKYC OTP plus video verification.

The private signing key for a Class 3 DSC is stored in a secure hardware cryptographic device meeting the applicable security requirements.

Common MCA Uses of DSC

Company Incorporation 

During incorporation, relevant subscribers, proposed directors and the practising professional use DSCs as required by the incorporation forms.

Related forms can include:

• SPICe+;
• e-MOA;
• e-AOA;
• AGILE-PRO-S; and
• linked declarations/forms.

LLP Incorporation

The proposed designated partner and certifying professional use DSCs as required through the FiLLiP process and linked forms.

Annual ROC Filing

DSCs are commonly used for forms such as:

• AOC-4 and applicable financial-statement forms;
• MGT-7 / MGT-7A;
• LLP Form 8;
• LLP Form 11; and
• other annual filing forms.

Event-Based Company Filings

DSCs can be required for forms relating to:

• appointment/resignation of directors;
• allotment of shares;
• changes in registered office;
• charges;
• auditor matters;
• resolutions;
• company closure/strike-off; and
• other statutory events.

Professional Certification

Where an e-form requires professional certification, the practising CA/CS/CMA uses their own DSC.

The professional's DSC should not be treated as a substitute for the DSC of a director/designated partner where the form separately requires both signatures.

How to Apply for a DSC in India in 2026

The exact user interface differs between Certifying Authorities, but the process generally follows the same regulatory framework.

Step 1: Choose a CCA-Licensed Certifying Authority

Before making payment, verify that the certificate will be issued by a CA currently licensed by CCA.

You can purchase:

• directly from a licensed CA; or
• through an authorised Registration Authority/reseller working with that CA.

The CA remains responsible for verification and issuance of the DSC.

Step 2: Select the Correct DSC Type

For routine MCA use, the usual selection is:

• Class 3
• Signature
• Individual or organisational-person profile as applicable
• 1-, 2- or 3-year validity depending on the product offered

For most directors/designated partners using MCA, a signature certificate is the core requirement.

If you also need:

• e-tender encryption;
• DGFT-specific usage;
• document signer certificate; or
• application-specific encryption,

select the relevant product separately.

Step 3: Complete KYC

CCA permits prescribed identity-verification methods.

Depending on the CA, applicant and product, KYC can use:

• Aadhaar OTP;
• Aadhaar biometric;
• video verification;
• paper/document-based verification; or
• other CCA-permitted KYC methods.

For Aadhaar-based eKYC, supporting identity documents may not be required in the same way as a paper KYC route.

Step 4: Provide Applicant Information

The CA normally collects information such as:

• applicant name;
• PAN where required for the intended application;
• email;
• mobile number;
• address;
• Aadhaar/KYC details where the Aadhaar route is selected; and
• organisation-related details where the DSC is issued in an organisational capacity.

The name should be consistent with the records used on MCA/PAN/DIN/DPIN where relevant.

Step 5: Complete Video / Personal Verification

For Class 3 issuance, the selected KYC route can require video verification or other prescribed identity-verification steps.

Follow the CA's instructions carefully.

Common causes of failure include:

• unclear video;
• mismatch in name;
• expired identity document;
• poor internet connection;
• incorrect PAN;
• mobile/email mismatch; and
• incomplete organisational authorisation.

Step 6: Pay the CA / Service Provider

DSC price is commercially determined and varies between providers.

Confirm whether the quote includes:

• certificate;
• USB cryptographic token;
• GST;
• KYC assistance;
• courier;
• download assistance; and
• reissue/replacement support.

Step 7: Generate / Download the Certificate to the Crypto Token

After approval, the certificate is downloaded or generated into the prescribed secure cryptographic medium.

For Class 3 signing keys, CCA requires secure hardware storage under the applicable certificate policy.

The USB token is therefore not merely a storage pen drive.

It is a cryptographic device designed to protect the private signing key.

Step 8: Change / Protect the Token PIN

Do not leave a default PIN unchanged.

Use a secure PIN known only to the subscriber.

Do not:

• write the PIN on the token;
• email the PIN;
• send token and PIN together to a consultant;
• share the token permanently with an accountant; or
• store the PIN in an unsecured shared spreadsheet.

Organisation DSC

Where the certificate represents a person in an organisational role, additional documents can include:

• organisation PAN;
• authorisation letter;
• employment/association evidence;
• entity registration details; and
• authorised signatory verification.

Always use the issuing CA's current checklist because the exact process differs by certificate profile and KYC route.

DSC Cost in India in 2026

Current online pricing observed for mainstream licensed-CA products shows that standard Class 3 signature certificates can commonly fall around:

These are market indications, not statutory fees.

For example, current reseller listings for certificates issued by licensed CAs show:

• some 2-year signature products with token around ₹1,500–₹2,300; and
• 3-year products with token around ₹2,000–₹3,200,

depending on brand and reseller.

Prices can change without regulatory amendment.

What Is the Validity of a DSC?

Under the CCA framework, a subscriber Digital Signature Certificate can have a maximum validity of three years.

Commercially, many CAs/providers offer:

• 1-year;
• 2-year; and
• 3-year

products, depending on certificate type.

A 2- or 3-year DSC is often more practical for a director or professional who regularly files forms.

Does a Digital Signature Become Invalid After DSC Expiry?

The certificate cannot be used to create new valid signatures after expiry.

However, CCA explains that a signature affixed while the certificate was valid is assessed with reference to the signing time.

Expiry of the certificate later does not automatically make a previously valid digital signature invalid.

DSC Renewal

"Renewal" is commonly used commercially, but technically the user receives a new certificate/new validity period under the CA's process.

Start renewal before expiry if the DSC is regularly used for:

• annual filings;
• tender deadlines;
• tax filings; or
• incorporation work.

Do not wait until the filing due date to discover that the DSC has expired.

Does Renewal Require KYC Again?

The process depends on the CA's current policy and regulatory requirements.

The subscriber may need to:

• complete fresh/revalidated KYC;
• perform video verification;
• authenticate identity; and
• download the new certificate.

Do not assume a renewal is merely an extension of the old certificate without verification.

Can the Same DSC Be Used on Multiple Portals?

CCA states that a person should ideally not need separate certificates for every application, provided the certificate satisfies the application's required assurance level and contains the required identity information.

A suitable Class 3 DSC may therefore be usable across multiple supported platforms.

However, each portal can impose its own:

• registration;
• PAN mapping;
• role mapping;
• certificate profile;
• browser/utility; and
• association requirements.

A DSC that works technically on one portal may still need separate registration or mapping on another.

DSC vs eSign — Are They the Same?

They are both electronic-signature mechanisms, but they are not identical in practical use.

Token-Based DSC

A traditional Class 3 DSC uses a certificate and private key stored in the prescribed secure hardware device.

It is commonly used where applications require:

• repeated signing;
• MCA filing;
• professional certification;
• tendering; or
• certificate-based authentication.

Aadhaar eSign

eSign is an electronic-signature service that can authenticate a signer through an electronic KYC mechanism for a specific transaction.

The user does not necessarily maintain the same hardware token used in a traditional DSC workflow.

Whether eSign can replace a token DSC depends entirely on the application.

For MCA filings requiring a DSC, do not assume that Aadhaar eSign is a substitute unless the specific MCA workflow expressly permits it.

DSC Security Rules Every Director and Professional Should Follow

A DSC carries legal significance because signatures created with the subscriber's private key can be attributed to that subscriber.

CCA specifically emphasises that the hardware cryptographic device should remain in the subscriber's custody.

Do

• keep the token personally controlled;
• use a strong PIN;
• change the default PIN;
• lock the token when not in use;
• check forms before signing;
• revoke the DSC if compromise is suspected;
• revoke organisational certificates where the role/employment relationship changes where appropriate; and
• renew before critical filing deadlines.

Avoid

• giving a consultant permanent custody of the token;
• sharing the PIN on WhatsApp/email;
• allowing blank or incomplete forms to be signed;
• using another person's DSC;
• retaining an ex-employee's organisational DSC for future signing;
• purchasing from an unverified source; or
• ignoring suspected compromise.

CCA states that an organisation should not retain the signature keys/certificate of an employee who exits; the certificate should be revoked and the keys destroyed as applicable.

What If the DSC Token Is Lost or Damaged?

If the hardware device containing the signing key is:

• lost;
• stolen;
• damaged; or
• suspected to be compromised,

contact the issuing CA promptly.

Revocation/reissue may be required.

CCA's end-entity signature guidance states that CAs should provide reissuance in prescribed circumstances during the validity period, subject to the applicable regulatory/service framework.

Do not continue treating a lost token as safe simply because you still know the password.

What If a Director Changes Company?

A DSC belongs to the individual subscriber, but the certificate profile and organisational information matter.

A personal/individual DSC may continue to be usable where the relevant application and profile remain valid.

Where the certificate is an organisational-person certificate tied to an employer/organisation, a role change can require revocation/reissue under the applicable CA process.

The DSC should never be transferred from the departing person to another employee or director.

Common DSC Problems on MCA V3

1. DSC Is Valid but MCA Says It Is Not Associated

The user may not have completed V3 DSC association.

2. User Is Registered as a Registered User, Not Business User

MCA requires supported signatories to use the appropriate Business User profile for DSC association.

3. Wrong MCA Role

A director attempting to associate under an unrelated role can face validation problems.

4. Token Driver Not Installed

The system cannot detect the certificate correctly.

5. MCA Bridge/Signing Utility Is Not Running

The browser cannot communicate with the cryptographic token.

6. Expired Certificate

The token may still be physically working, but the certificate itself has expired.

7. Old DSC Associated, New DSC Not Re-associated

After renewal/reissue, the new certificate may need fresh association on the portal.

8. PAN / Name Mismatch

The certificate details may not match MCA/PAN/profile information.

9. Wrong Certificate Selected

A token can contain more than one certificate.

Choose the correct signing certificate.

10. PIN Locked

Repeated incorrect PIN attempts can lock the token.

Follow the token/CA recovery process rather than repeatedly guessing.

Can a CA or Consultant Keep the Client's DSC Token?

From a security and governance perspective, this is poor practice.

CCA's framework places custody of the signing key with the subscriber.

A professional can:

• prepare the form;
• review it;
• explain it;
• send it for signing; and
• guide the user through signing.

But the subscriber should retain control over:

• the token;
• PIN; and
• decision to affix the signature.

A DSC should not be treated like a password that a client hands over permanently to a filing agent.

Frequently Asked Questions

1. What is a Digital Signature Certificate?

A DSC is an electronic certificate issued by a CCA-licensed Certifying Authority that links a subscriber's verified identity with a cryptographic key and enables secure digital signing of electronic records.

2. Which DSC is required for MCA in 2026?

A Class 3 signature DSC is the practical standard commonly used for MCA filings. The certificate should contain the identity information required by the MCA application and must be associated with the user's MCA V3 Business User profile.

3. How much does a DSC cost in India?

There is no fixed Government retail price. A standard Class 3 signature DSC for two or three years with token commonly falls roughly in the ₹1,500–₹3,200 range in current market listings, though price varies by CA, reseller, token, validity and support.

4. What is the validity of a DSC?

Subscriber DSC validity can be up to three years under the CCA framework. Providers commonly offer one-, two- or three-year certificates depending on the product.

5. Is a USB token mandatory for Class 3 DSC?

Class 3 signing keys are required to be stored in an approved secure hardware cryptographic device under the applicable CCA framework. In practice, this is commonly supplied as a USB crypto token.

6. Can I use the same DSC for MCA and other portals?

Often yes, provided the certificate meets the other portal's assurance and identity requirements. Each portal may still require separate registration or mapping.

7. Is a combo DSC required for MCA?

Not merely for signing MCA forms. A signature certificate performs the signing function. A signature + encryption combo is useful only where encryption is separately required.

8. How do I register my DSC on MCA V3?

Register or upgrade to the relevant MCA Business User role, use the Associate DSC service, run the required MCA signing/bridge software, connect the token, select the certificate and complete association using the token PIN.

9. Can my CA or CS keep my DSC token and PIN?

The DSC/private key should remain under the subscriber's control. A professional can prepare and assist with filings, but permanent custody of the token and PIN by another person creates security and governance risk.

10. What happens when my DSC expires?

It cannot be used for new valid signatures after expiry. Obtain a renewed/new certificate through the issuing CA and re-associate it on portals such as MCA where required. A signature validly affixed before certificate expiry does not automatically become invalid merely because the certificate later expires.

Need Help With DSC for MCA Filings?

A DSC purchase is only one part of the process. The certificate must have the correct profile, be installed securely and be properly associated with the relevant MCA V3 Business User before it can be used for filings.

Compliance Desk can help you identify the DSC required for your MCA work and support the related company, LLP and ROC filing process.

Explore Compliance Desk services or review available service and pricing options.

Disclaimer

This article is for general informational purposes and reflects the CCA and MCA digital-signature framework reviewed as of 04 November 2026. Certifying Authority products, retail pricing, KYC processes, portal software and MCA procedures can change. Users should verify current requirements with the Controller of Certifying Authorities, the relevant licensed CA and the application portal before purchasing or using a DSC.