Key Takeaways
- A Digital Signature Certificate (DSC) is the electronic equivalent of a physical signature, legally valid under Section 3 of the Information Technology Act, 2000.
- Post-January 2021, India has only one class of DSC (equivalent to the former Class 3). The old Class 2 category stands abolished.
- DSC is mandatory for company directors filing on the MCA portal, companies filing ITR-6, LLPs filing GST registration, and establishments filing EPFO ECR returns (50+ employees).
- Individuals and HUFs can use Aadhaar OTP or EVC to verify their income tax returns; they do not need a DSC.
- DSC validity ranges from 1 to 3 years. An expired DSC cannot be renewed: you must obtain a fresh certificate.
- Cost ranges from Rs 500 to Rs 2,000 depending on validity period and the Certifying Authority.
- The DSC must be registered on each portal separately (income tax e-filing, MCA V3, GST portal) before you can use it for signing.
A Digital Signature Certificate is the foundational credential for electronic filing in India's compliance ecosystem. If you are a company director, a designated partner of an LLP, or a CA signing audit reports, you cannot transact on government portals without one. The certificate binds your identity (verified against PAN and Aadhaar) to a cryptographic key pair stored on a USB token, making your electronic signature legally equivalent to a wet-ink signature under the IT Act 2000.
This guide covers the current DSC framework as of 2026: what changed after the 2021 reclassification, where DSC is mandatory versus optional, how to obtain one, and the practical issues that trip up filers every compliance season.
Looking for expert help with digital signature certificate DSC tax filing company compliance India 2026? The team at Tax Garden, based in Kondapur, Hyderabad, helps Indian SMEs stay compliant end-to-end: filings, notices, and advisory, all in one place.
What Is a Digital Signature Certificate
A DSC is an electronic credential issued by a licensed Certifying Authority (CA) under the Controller of Certifying Authorities (CCA), Government of India. The legal basis is Section 35 of the Information Technology Act, 2000. The certificate contains your name, PAN, email, public key, the CA's identity, and the certificate's validity period, all cryptographically signed by the issuing CA.
When you sign a document with your DSC, the recipient can verify two things: (1) the document was signed by you and not tampered with, and (2) your identity was verified by a government-licensed CA at the time of issuance.
How DSC Differs from eSign
| Parameter | DSC (USB Token) | eSign (Aadhaar-based) |
|---|---|---|
| Authentication | Cryptographic key on hardware token | Aadhaar OTP (one-time) |
| Validity | 1-3 years (reusable) | Single transaction |
| Who can use | Anyone (individuals, companies, LLPs) | Individuals with Aadhaar only |
| MCA filings | Accepted | Not accepted |
| ITR for companies | Accepted (mandatory) | Not accepted |
| ITR for individuals | Accepted | Accepted (via Aadhaar OTP/EVC) |
| Cost | Rs 500-2,000 | Rs 15-20 per transaction |
Types of DSC: Post-2021 Reclassification
Before January 2021, India had three classes of DSC:
- Class 1: Basic identity verification (email only). Discontinued.
- Class 2: Identity verified against a trusted database (PAN, Aadhaar). Used for most ROC and tax filings.
- Class 3: In-person or video verification. Used for e-tendering and high-value transactions.
Post-January 2021, the CCA abolished the class system entirely. Now there is only one type of DSC, which requires the same level of identity verification that the old Class 3 demanded (video-based verification). All references to "Class 2" or "Class 3" in legacy documentation should be read as simply "DSC."
Additionally, a Document Signing Certificate exists for organisations (not individuals) to sign bulk documents programmatically, but this is not relevant for tax or company compliance.
Where DSC Is Mandatory in India
Income Tax Department
| Filing | DSC Required? | Alternative |
|---|---|---|
| ITR-6 (companies) | Mandatory | None |
| ITR-5 (LLPs, firms) | Optional | EVC via authorised partner |
| Tax Audit Report (Form 3CA/3CB/3CD) | Mandatory for signing CA | None |
| ITR-1 to ITR-4 (individuals, HUFs) | Optional | Aadhaar OTP or EVC |
Company directors designated as authorised signatories must have their DSC registered on the income tax e-filing portal before the ITR-6 filing window opens. Without this, the XML upload will fail at the signature stage.
MCA / Registrar of Companies
Every single filing on the MCA V3 portal requires DSC. There is no exception:
- Company incorporation (SPICe+ forms)
- Annual returns (MGT-7, MGT-7A)
- Financial statements (AOC-4)
- Charge creation and modification (CHG-1, CHG-9)
- Director appointment/resignation (DIR-12)
- Change of registered office (INC-22)
- Strike-off applications (STK-2)
Every director whose DIN is linked to the company must have a valid DSC registered on the MCA portal. The designated Company Secretary (if any) also needs one.
GST Portal
- GST registration for companies and LLPs: DSC mandatory at the application stage
- GSTR-9/9C (annual return): DSC mandatory for companies; other taxpayers can use EVC
- GSTR-1, GSTR-3B: EVC accepted for all taxpayers including companies (DSC optional)
EPFO
Establishments with 50 or more employees must file Electronic Challan cum Return (ECR) using DSC. Smaller establishments can use Aadhaar-based eSign.
DGFT
All Import Export Code (IEC) applications and modifications on the DGFT portal require DSC for companies and LLPs.
How to Obtain a DSC
Step 1: Choose a Licensed Certifying Authority
The CCA licenses these organisations to issue DSCs in India:
| Certifying Authority | Website |
|---|---|
| eMudhra | emudhra.com |
| Sify Technologies | safescrypt.com |
| Protean (formerly NSDL) | protean-tinpan.com |
| Capricorn Identity Services | capricornica.com |
| IDRBT | idrbtca.org.in |
| CDAC | cdac.in |
| NIC | nicca.nic.in |
| n(Code) Solutions | ncodesolutions.com |
Step 2: Submit Application
- Visit the CA's portal and select "Individual DSC" (for directors/partners) or "Organisation DSC"
- Fill in: Name (as on PAN), PAN number, email, mobile number
- Upload: PAN card copy, Aadhaar card copy, passport-size photo
- Complete video verification: the CA's representative conducts a live video call (typically 2-3 minutes) to verify your identity against your Aadhaar photo. This replaced physical in-person verification post-COVID.
Step 3: Receive USB Token
Once verified (typically within 24-48 hours), the CA issues the DSC on a USB cryptographic token. Some CAs ship the physical token; others allow download onto your existing token if you already have one.
Validity and Renewal
| Validity Period | Typical Cost (Individual) |
|---|---|
| 1 year | Rs 500-800 |
| 2 years | Rs 800-1,200 |
| 3 years | Rs 1,200-2,000 |
Critical rule: You must renew your DSC before it expires. Once a DSC expires, it cannot be renewed. You will need to apply for a completely new certificate, repeat the video verification, and re-register the new DSC on all portals. Many compliance deadlines have been missed because a director's DSC expired in September and the ITR-6 deadline was October 31.
Set a calendar reminder at least 30 days before expiry.
Registering DSC on Government Portals
Obtaining the DSC is only half the process. You must register it on each portal where you intend to use it:
Income Tax E-Filing Portal
- Login with PAN credentials
- Navigate to My Profile, then Register Digital Signature Certificate
- Download the DSC utility, sign the generated file with your USB token
- Upload the signed file to complete registration
MCA V3 Portal
- Login with your Business User credentials
- Associate your DSC through the "My Profile" section
- The system validates the PAN on the DSC against the DIN/DPIN records
GST Portal
- Login, navigate to Register/Amend DSC
- Select the PAN of the authorised signatory
- Sign using the emSigner utility (Java-based applet that detects your USB token)
USB Token vs Cloud-Based Signing
The standard DSC resides on a USB cryptographic token: a small hardware device that stores your private key. The key never leaves the device, which is what makes it secure.
Cloud-based signing solutions (Remote Signing) are emerging, where the private key is stored in a Hardware Security Module (HSM) in a data centre and you authorise each signature via OTP. However, as of 2026, government portals (MCA, Income Tax, GST) do not universally support remote signing for compliance filings. USB tokens remain the standard.
Practical implications of USB tokens:
- Lose the token, lose the DSC: you must get a new one issued
- Only one person can sign at a time (physical possession required)
- Token drivers (e.g., ePass2003, WatchData) must be installed on the computer
- Works across Windows only for most portal utilities (limited macOS/Linux support)
Common Issues and Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
| "DSC not registered" error on portal | DSC not linked to your account on that specific portal | Register DSC separately on each portal |
| Token not detected | Driver not installed or outdated | Download latest driver from token manufacturer (ePass2003 or Watchdata) |
| PAN mismatch | PAN on DSC differs from PAN on portal account | Get DSC reissued with correct PAN, or update portal records |
| Expired DSC | Validity period ended | Apply for a fresh DSC (renewal not possible post-expiry) |
| "Signing failed" on MCA | Java/emSigner version conflict | Update Java to latest version, clear browser cache, use recommended browser |
| Multiple DSCs on same token | Portal picks wrong certificate | Remove old/expired certificates from the token using the token management utility |
eSign as an Alternative for Individuals
Aadhaar-based eSign (under the eSign framework of CCA) provides a lightweight alternative for individuals who do not need recurring digital signatures:
- Valid for a single transaction only
- Authenticated via Aadhaar OTP (sent to Aadhaar-linked mobile)
- Costs Rs 15-20 per signature (charged by the eSign provider)
- Accepted for: individual ITR filing, GST returns (non-company), partnership deed registration
Not accepted for: MCA filings, company ITR-6, any filing where a company director or designated partner must sign. For these, only a full DSC on USB token is valid.
Practical Recommendations
- For company directors: Obtain a 2-year or 3-year DSC immediately after appointment. Register it on MCA, Income Tax, and GST portals within the first week.
- For CAs signing audit reports: Maintain a separate DSC exclusively for professional use. Track expiry dates for all client-facing DSCs you manage.
- For startups with multiple directors: Only the authorised signatory needs a DSC for income tax and GST filings, but ALL directors need DSC for MCA filings (DIR-12, board resolutions).
- Renewal discipline: Create a compliance calendar entry 45 days before DSC expiry. A lapsed DSC in October can mean a missed ITR-6 deadline and a Rs 5,000 late fee under Section 234F (minimum), plus interest under Section 234A.
DSC is not a one-time setup. It is a recurring compliance input that must be maintained, tracked, and renewed proactively. Treat it with the same discipline as your DIR-3 KYC or GST return calendar.