What Is a Digital Signature Certificate (DSC), and How Do You Get One?

There's an important distinction hiding behind two things that sound similar: drawing or typing a signature and placing it on a PDF — covered in our guide to signing a PDF online — versus a Digital Signature Certificate (DSC), a cryptographic identity issued by a licensed authority that certain official filings in India specifically require by law. One is a visible mark on a page. The other is a verifiable cryptographic proof of identity attached to a document. Confusing the two is common, and it matters, because a filing that requires a DSC will simply reject a document signed any other way.

What a DSC actually is

A Digital Signature Certificate is a cryptographic key pair — a private key kept securely by the holder and a matching public key certified by a licensed Certifying Authority (CA) — that lets a document be signed in a way that's mathematically verifiable and tamper-evident. Once a document is signed with a DSC, any change to it afterward invalidates the signature, which is fundamentally different from a signature image sitting on top of a PDF page, where the underlying document could in principle be altered without the image itself showing any sign of it. The certificate ties the key pair to a verified identity — an individual or an organisation — issued only after the Certifying Authority completes identity verification, which is what gives a DSC its legal standing.

DSC classes — and why you'll mostly hear about Class 3 today

Digital Signature Certificates in India used to be issued in different classes reflecting different levels of identity assurance, but Class 3 is the standard class issued for essentially all purposes today — company and LLP filings, income tax, GST, e-tendering and trademark filings all require Class 3 in current practice. Class 3 requires stronger identity verification than the older classes it superseded, which is exactly why it's trusted for higher-stakes filings. If you're obtaining a DSC for any of the standard business or compliance purposes below, Class 3 is what you'll be issued — there's little reason to look for anything else.

Who actually needs a DSC

• Companies and LLPs filing with the Ministry of Corporate Affairs (MCA) — incorporation documents, annual returns, and most statutory filings require a director's or authorised signatory's DSC.
• Certain GST registrations and returns, particularly for companies and LLPs, where DSC-based signing is mandatory rather than optional.
• Income tax filings for specific categories of taxpayers (companies, and individuals whose accounts require statutory audit) where digital signing is a filing requirement, not a convenience.
• E-tendering and e-procurement portals, where bids and submissions commonly require a DSC to be considered valid.
• Trademark and patent filings with the Indian intellectual property offices, which accept DSC-signed applications.

DSC vs Aadhaar eSign vs a simple signature image

These three are genuinely different tools solving different problems, and mixing them up is the single most common point of confusion. A simple signature image — drawn or typed and placed on a PDF page — is a visible mark of agreement, suitable for everyday documents like leases, internal approvals and informal contracts, but it carries no cryptographic verification and isn't accepted where a filing specifically requires certified signing. Aadhaar eSign is a government-provided electronic signature service that uses Aadhaar-based OTP or biometric authentication to sign a document, commonly used for certain government portal submissions where it's explicitly accepted as an alternative to a DSC. A DSC is the strongest of the three — a certificate-based cryptographic signature issued by a licensed CA, required specifically where the law names it as mandatory, such as most MCA filings.

Step-by-step: how to actually obtain a DSC

1. Choose a Certifying Authority licensed by India's Controller of Certifying Authorities (CCA) — several are authorised to issue DSCs, and any of them can issue a Class 3 certificate valid for the same range of purposes.
2. Complete identity verification — this is typically done through video verification or Aadhaar-based eKYC today, a considerably faster process than the paper-based verification DSCs historically required.
3. Choose your signing medium: a physical USB token (the traditional, still widely used method, where the private key is stored securely on hardware) or a cloud/software-based signing option offered by some providers.
4. Receive your DSC — a USB token arrives physically or a software certificate is issued for installation, along with the signing software or driver needed to actually use it.
5. Install the signing software and register the DSC with whichever portal you need to file through (MCA, the GST portal, an e-tendering system) — most portals have their own DSC registration step separate from simply owning the certificate.

DSC expiry and renewal

A DSC isn't valid indefinitely — it's issued with a fixed validity period, commonly one to three years depending on what's purchased, after which it expires and can no longer be used to sign anything until renewed. This catches people off guard more often than it should: a DSC that worked fine for the last three annual filings can suddenly fail on the fourth simply because it lapsed, with no warning beyond whatever the certifying authority's own renewal reminder (if any) provided. Diarising the expiry date somewhere you'll actually see it, rather than discovering it mid-filing, is worth the two minutes it takes.

Using a DSC once you have one

In practice, a DSC gets used through whichever portal or signing software supports it rather than as a standalone action — the MCA portal, for instance, has DSC signing built directly into its e-filing workflow, prompting you to select and apply your registered DSC at the point a form requires it. Standalone documents (a PDF that needs a DSC-based signature outside of a specific government portal's workflow) are typically signed using the signing software or utility provided alongside the DSC itself, which embeds the actual cryptographic signature into the file rather than a visible image.

USB token vs cloud/software-based signing

A physical USB token is the traditional, still most common way to hold a DSC's private key — the key never leaves the hardware device, which is a genuine security advantage, but it also means the certificate is only usable on a machine with that specific token physically plugged in, and losing the token means losing access until a replacement is issued. Some Certifying Authorities now also offer cloud-based or software signing, where the key is held securely on the provider's infrastructure instead of a physical device, letting you sign from any authorised device without carrying hardware around. This trades a small amount of the "key never leaves a physical object you control" assurance for genuine convenience, and which one makes sense depends on how often you sign, from how many locations, and how strictly your organisation's own policy treats key custody — a company issuing DSCs to many authorised signatories may standardise on one approach for consistency rather than leaving it to individual preference.

DSC for an individual vs a company

A DSC is always issued to a specific person, never directly to a company as an abstract entity — even a "company DSC" is technically issued to a named individual (a director or an authorised signatory) acting in that capacity, with the certificate reflecting both their identity and their organisational role. This matters practically: if the authorised signatory changes — someone resigns, a new director is appointed to handle filings — a fresh DSC needs to be obtained for the new individual rather than simply reassigning the old one, since the certificate is tied to that specific person's verified identity, not to a role that can be handed off. Keeping track of which DSC belongs to which currently-authorised individual is a genuine, easy-to-overlook piece of housekeeping for any company that changes signatories over time.

What it actually costs and how long issuance takes

Pricing and turnaround vary by Certifying Authority and by validity period chosen (a longer validity certificate costs more upfront but avoids a nearer-term renewal), so it's worth treating any specific number you've heard as something to confirm directly with a licensed CA rather than assuming a fixed, universal price — the details here genuinely differ provider to provider and change over time. What's more consistent is the shape of the process: identity verification (now commonly same-day via video or Aadhaar eKYC, versus the multi-day paper verification DSCs used to require) followed by issuance of the token or software certificate, meaning a DSC obtained through a straightforward provider today is typically a matter of days rather than the longer waits from a few years ago.

What to do if a DSC token is lost or compromised

A lost USB token, or a private key you suspect has been compromised, should be reported to the issuing Certifying Authority so the certificate can be revoked — a revoked DSC can no longer be used to sign anything valid, which is exactly the point if it's fallen into someone else's hands. Reissuance then follows the same identity-verification process as the original issuance, since a CA won't simply hand over a fresh token without re-confirming who they're issuing it to. This is also a reason not to delay reporting a lost token: the window between losing it and reporting it is the window in which someone else could potentially misuse it if they found or intercepted it, so treating it with the same urgency as a lost identity document is the right instinct.

Renewing a DSC vs starting from scratch

Renewing an existing DSC before it expires is generally a lighter process than the original issuance, since the Certifying Authority already has your verified identity on file from the first round — many CAs offer a streamlined renewal flow that skips a full re-verification, provided it happens before the certificate actually lapses. Once a DSC has already expired, though, some providers treat a renewal request the same as a fresh application, requiring the full identity verification process again rather than a lighter renewal path — which is one more reason renewing ahead of the expiry date, rather than after, is worth the small effort of tracking it in the first place.

Common mistakes

• Assuming a signature image or Aadhaar eSign satisfies a requirement that specifically calls for a DSC, and having the filing rejected as a result.
• Letting a DSC expire without noticing, then discovering it only when an urgent filing fails.
• Registering a DSC with one portal but assuming it's automatically usable on another — many portals require their own separate DSC registration step even for an already-issued certificate.
• Losing the USB token without having planned for reissuance, which can delay a time-sensitive filing significantly since a replacement requires going through issuance again.
• Sharing a DSC's private key or USB token with someone else — a DSC is tied to a specific individual's or entity's identity, and using it on someone else's behalf undermines exactly the verification it's meant to provide.
• Continuing to use a departed director's or signatory's old DSC instead of obtaining a fresh one issued to whoever currently holds that role.

The short version: a Digital Signature Certificate is a cryptographic, certified identity — not a picture of a signature — issued by a licensed Certifying Authority and required specifically for certain MCA, GST, income tax, e-tendering and IP filings. A simple signature image is enough for everyday documents; Aadhaar eSign covers certain government portal submissions; a DSC is the one the law names explicitly for the filings above. Obtain one through a licensed CA with identity verification and a USB token or software certificate, keep track of its expiry, report a lost token immediately for revocation, and register it separately with each portal that requires it.