A digital signature certificate (DSC) is an electronic credential issued by a Certifying Authority licensed under the IT Act 2000, and it is how directors, partners and authorised signatories sign MCA, income-tax and many other filings. Since Class 2 is no longer issued on its own, the certificate people now buy is a Class 3 signing DSC, valid for up to 3 years and stored on a hardware crypto token.
Which DSC class do you need for MCA, GST and income tax?
Buy a Class 3 signing certificate. The CCA's Identity Verification Guidelines bar CAs from issuing a Class 2 individual signing certificate alone, and every Class 3 signing certificate carries the Class 2 identifier as well, so it works wherever either class is accepted.
That covers the main portals:
| Portal | What it accepts or requires |
|---|---|
| MCA | A Class 2 or Class 3 signing certificate from a licensed CA, linked to your login through the "Associate DSC" service |
| Income tax e-filing | A Class 2 or 3 DSC, registered against your PAN; mandatory for returns of companies, political parties and taxpayers whose accounts must be audited |
| GST | Filings can be signed with a DSC or e-signature, or verified by EVC (rule 26 of the GST rules) |
Pick "signing" unless a portal specifically asks for encryption. An encryption certificate is different: the CA must hold the key in escrow for at least 7 years after expiry so that encrypted documents can still be opened.
Who needs a digital signature certificate?
Anyone who signs electronic filings for a business. In practice that means every director or designated partner who signs incorporation and annual forms, the principal contact who verifies a company's income-tax return, and professionals who certify forms. A director filing DIR-3 KYC needs a DSC only when changing a mobile number, email or address.
Common triggers for getting your first DSC:
- Starting a company or LLP. SPICe+ and FiLLiP are signed digitally, so DSCs come before private limited company registration.
- Becoming a director. MCA forms carry a director's digital signature box, so most directors need their own DSC; see DIN registration.
- Tax audit or company returns. The income-tax portal will not accept these returns without a registered DSC.
- Changing KYC details. A DIN holder updating contact details signs with a DSC; the DIR-3 KYC due date tool shows when your next KYC falls.
How to get a DSC: the official verification process
The Controller of Certifying Authorities (CCA) licenses CAs but does not issue DSCs to the public itself; you apply to a licensed CA or through its partner. Under the CCA's Identity Verification Guidelines (version 2.6, 16 June 2026) the process is online and works like this:
- Open an eKYC account with the CA. It is built from Aadhaar eKYC, PAN eKYC, bank eKYC or your organisation's KYC, and the CA verifies your mobile number by OTP and your email.
- PAN check. The CA verifies your PAN against the income-tax database and accepts it only if the name and date of birth match and the PAN is active.
- Video verification. Except on the bank eKYC route, a live video call with the CA, or Aadhaar biometric authentication, carried out within the last 2 days before issuance. You show original documents where needed.
- Sign the application. The form is generated from your verified eKYC data and you sign it with the CA's eSign. A power of attorney is not allowed.
- Generate the key on a token. The key pair is created inside a validated hardware crypto token, using the CA's software.
- Download within 30 days. After 30 days from approval, the CA must verify you again.
The eKYC account itself is valid for up to 2 years, after which it needs fresh verification. The CA issues a GST tax invoice for the certificate.
Documents for a DSC: Indian, organisational and foreign applicants
Indian applicants must give either PAN or Aadhaar, and every applicant needs a mobile number and an email address. What else you need depends on the route.
| Applicant | What the CA needs |
|---|---|
| Individual, Aadhaar eKYC | No supporting documents; video verification or biometric check |
| Individual, PAN eKYC | PAN and a government ID with address, both shown in original on video |
| Organisational person | Your eKYC account, ID or proof of link with the organisation, an authorisation letter from its authorised signatory and proof the organisation exists |
| Foreign applicant | Passport, OCI or local government ID; address proof such as a utility bill issued within three months or an embassy document; video verification |
A single-director company can self-authorise if the CA verifies the details on the MCA website, and a proprietor needs no authorisation at all. The name on the DSC must match the eKYC source; where PAN and Aadhaar spell it differently, the CA lets you choose which to use.
What does a DSC cost, and how long is it valid?
You buy a DSC from a licensed CA, which sets its own price and issues a GST invoice; the token is a separate hardware item. The CCA's Certificate Policy caps a personal signing certificate at 3 years, and CAs offer terms within that limit.
Ofin's two-year Class 3 signing DSC costs ₹1,999 including GST. If you form a company with Ofin, check your package first: our Section 8 company and private company packages already include DSCs.
The 2026 token change: FIPS 140-2 to FIPS 140-3
Old USB tokens are the trap of 2026. A CCA advisory asks CAs to stop issuing DSCs on FIPS 140-2 tokens by 21 September 2026; certificates already downloaded on such tokens keep working until they expire but cannot be renewed or downloaded again on them.
What this means in practice:
- Renewing after 21 September 2026. Budget for a new FIPS 140-3 token instead of reusing the old one.
- Reissue exception. If an active DSC must be reissued to the same person, the CA may reissue it once, free, on the old token for the remaining validity.
- Software. CCA has asked portals and developers to support SHA-2 and FIPS 140-3 devices, so keep your token drivers and signing utility updated.
Common DSC problems and how to avoid them
DSC trouble tends to surface at filing time, so check these well before a deadline:
- Expired certificate. MCA and the income-tax portal need the new DSC registered or associated again before you can sign.
- Locked token. CAs do not reset a token PIN unless the token is wiped; the CA must then reissue the certificate free at least once.
- Default password. CAs will not download a DSC to a token that still has its default password.
- Shared DSC. The income-tax portal does not let two users register the same DSC, and only the person named should ever use it.
- Wrong details. Misrepresenting or hiding facts to obtain a DSC is punishable under section 71 of the IT Act with up to 2 years' imprisonment, a fine of up to ₹1 lakh, or both.
How Ofin handles your DSC
Ofin's team checks which route suits you, guides you through the CA's eKYC and video verification, and shows you how to register the certificate on MCA, income tax or GST once it is downloaded, 100% online. A two-year Class 3 signing DSC costs ₹1,999, and we reply within 24 hours. Tell us who needs one to get a fixed-price proposal.
