Digital Signature Certificate (DSC): Types, How to Apply, and When You Need One
Most ROC filings simply can't be attempted without a valid DSC on file for a director. Here's what it actually is, how to get one, and how to avoid the renewal trap that stops a filing cold.
CA Helper Editorial Team
How we research and reviewPublished · 6 min read
Key takeaways
- A DSC is issued to an individual, not a company. Every director or designated partner who needs to sign filings needs their own certificate.
- Class 3 is now the standard and effectively the only class accepted for MCA, GST, income tax, and e-tendering filings.
- Getting one requires PAN, Aadhaar, and video-based identity verification through a licensed certifying authority, and it's issued on a USB security token.
- A DSC is typically valid for one or two years and gives no advance warning before it expires, so track the expiry date the same way you'd track any compliance deadline.
- At least one director needs an active DSC before most ROC filings, including incorporation itself, can even be attempted.
A Digital Signature Certificate, a DSC, is the electronic equivalent of a handwritten signature or a company seal: a credential, issued by a government-licensed certifying authority, that lets someone sign a document online in a way the receiving system can verify as genuinely theirs and tamper-evident. For a private limited company or LLP, this isn't optional infrastructure, most MCA filings, from incorporation onward, simply cannot be submitted without a valid DSC attached to a director or designated partner. It's one of the first practical things to sort out when setting up a company, not something to scramble for once a filing deadline is already close.
It Belongs to a Person, Not a Company
This trips up a surprising number of first-time founders: a DSC is issued to an individual, not to a business. A director signs company filings using their own personal DSC, tied to their own identity, rather than one issued in the company's name. That means every director or designated partner who needs to sign filings on the company's behalf needs their own individual DSC, and a company with three active directors, all expected to sign different filings over time, may need three separate certificates rather than one shared one.
Class 3: The Only Class That Matters Now
DSCs used to come in multiple classes with different levels of verification, but Class 3 is now effectively the standard, and the only class accepted for the filings that actually require one. It covers MCA filings for incorporation and annual returns, GST registration and returns above the applicable threshold, income tax filings that require digital signing, and e-tendering. If a certifying authority offers you anything other than Class 3 for a business or compliance purpose, that's worth questioning rather than accepting.
How to Actually Get One
- Choose a certifying authority licensed by the Controller of Certifying Authorities to issue Class 3 DSCs.
- Submit identity and address proof, typically PAN and Aadhaar, along with a passport-size photograph.
- Complete identity verification, most certifying authorities now do this through a video verification call rather than in person, in addition to Aadhaar-based e-KYC.
- Pay the applicable fee, which varies by certifying authority and by the validity period chosen (typically one or two years).
- Receive the DSC loaded onto a USB security token, since it's stored on physical hardware for security rather than as a downloadable file sitting on your computer.
- Register the DSC on the relevant portal, the MCA portal, the GST portal, or the income tax e-filing portal, associating it with your PAN or DIN before you can actually use it to sign a filing there.
The Renewal Trap
A DSC is typically valid for one or two years, and it doesn't send a warning when it's about to lapse the way a subscription service might. An expired DSC simply stops working the moment you try to use it, which means the worst time to discover an expired certificate is exactly when a filing deadline is close and you need it to sign something immediately. Renewal has to be applied for again, essentially repeating the original application, so the practical habit is to track your DSC's expiry date the same way you'd track any other compliance deadline, and start renewal a few weeks before it lapses rather than the day it does.
Where You'll Actually Need One
| Filing or Process | Who Needs the DSC |
|---|---|
| Company incorporation (SPICe+) | Proposed directors and subscribers to the memorandum |
| Annual ROC filings (AOC-4, MGT-7/MGT-7A) | At least one director, and the certifying professional if applicable |
| GST registration and returns above the threshold | An authorised signatory of the business |
| Income tax filings requiring digital verification | The individual or authorised signatory filing the return |
| E-tendering and e-procurement portals | The authorised representative bidding on behalf of the business |
Frequently asked questions
Can a company have its own DSC instead of relying on a director's personal one?
No. A DSC is issued to an individual, verified against their own identity, not to a company as a legal entity. Every filing that needs a company's digital signature is actually signed using an authorised individual's, typically a director's or designated partner's, personal DSC.
How long does it take to get a DSC?
Once identity documents are ready and video verification is completed, most certifying authorities issue a Class 3 DSC within a day or two. The more common delay is on the applicant's side, gathering the right documents or completing verification promptly, rather than the certifying authority's processing time.
What happens if I try to file with an expired DSC?
The filing simply fails, an expired DSC does not work for signing, it doesn't downgrade to a warning or a grace period. If this happens close to a statutory deadline, you're now racing to get a new DSC issued and registered before the deadline passes, which is exactly why tracking expiry dates proactively matters.
Do I need a new DSC if I lose my USB token?
Yes, in practice. A lost token means a lost private key, which cannot simply be reissued onto a new device, and most certifying authorities require the certificate to be revoked and reapplied for on a fresh token.
Is a DSC the same as an Aadhaar-based e-sign?
No, they're related but distinct. Aadhaar e-sign is a one-time, OTP-based signing method used for specific limited purposes, while a Class 3 DSC on a USB token is a more robust, reusable credential required for the broader range of MCA, GST, and other regulatory filings covered here.
Sources and official references
Rules and rates change. These are the primary sources for the topics covered above, and the place to confirm anything before you act on it.
Disclaimer
This article is for general informational purposes only and does not constitute professional tax, legal, or financial advice. Rules and rates change, so consult a qualified Chartered Accountant for advice specific to your situation.
Related reading
Company Law & ROCStatutory Registers Every Private Company Must Maintain
A company can be fully up to date on every ROC filing and still be non-compliant. Statutory registers are a separate, continuous obligation, and nothing reminds you when one falls out of date.
Company Law & ROCWinding Up vs Strike Off: Which Route Actually Fits Your Company
Not every company that wants to close qualifies for strike-off. Here's how to tell whether the simple STK-2 route actually applies to yours, or whether you need a proper winding-up process instead.
Company Law & ROCCharge Registration (CHG-1): Why an Unregistered Charge Can Cost a Lender Everything
A loan can be fully documented and fully secured, and still rank behind every other creditor in insolvency if the charge was never registered with the ROC. Here's what Form CHG-1 actually protects.