What is a DSC? Signature vs encryption certificates, explained properly

A Digital Signature Certificate (DSC) is India’s legally recognised electronic signature under the Information Technology Act, 2000. It is issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA): eMudhra, Capricorn, Sify, (n)Code Solutions, Vsign and Pantasign are the main ones. If you are incorporating a company, every director needs one, because MCA forms can only be signed digitally.

That much every provider will tell you. Here is the rest, which most will not.

Only Class 3 exists now

You will still see websites selling “Class 2” DSCs or explaining the difference between classes. Ignore them. The CCA discontinued Class 2 certificates from 1 January 2021. Everything today, from MCA filings to GST to tenders, runs on Class 3, which requires in-person or video verification of your identity. If someone quotes you a Class 2 price, you are reading a stale page.

The variants that actually matter

A Class 3 DSC comes in a small matrix, and the price and paperwork differ across it:

Variant	Issued to	Typical use
Individual, sign only	A person, in their own name	MCA filings, GST, income tax, EPFO, trademark filings
Individual or Organisation, sign + encrypt (“combo”)	A person, or a person mapped to an organisation	Government e-procurement and tender portals
Organisation, sign only	A person as an authorised signatory of an entity	Filings made on behalf of the organisation
Document Signer Certificate	A server or application, not a person	Automated bulk signing of invoices and documents

Validity is 1, 2 or 3 years, and the certificate lives on a FIPS-certified USB token that you buy with it. Typical street price for an individual sign-only Class 3 is Rs 1,500 to 2,500 depending on validity and vendor; the encryption add-on for a combo is usually around Rs 1,000 more, and organisation combos with a token land around Rs 3,000 to 4,000.

Signature vs encryption: two different keys doing two different jobs

This is the question we get asked most, usually by someone who has been told to buy a “combo DSC” for a tender and wants to know why the plain one they already own is not enough.

A combo DSC holds two separate certificate and key pairs on the same token.

The signature certificate proves you wrote something. When you sign a document, your private key produces a cryptographic seal over it. Anyone can verify the seal with your public certificate, and any change to the document after signing breaks it. This is what MCA, GST and income tax portals use. Signing is about authenticity and non-repudiation: you cannot later deny you signed it.

The encryption certificate lets others send secrets to you. Someone encrypts a file with your public encryption key, and only your private encryption key can open it. This is about confidentiality, and it is why tender portals demand it: when you submit a bid on a government e-procurement portal, the bid is encrypted so that nobody, including the department, can read it before the official bid-opening event. Without an encryption certificate the portal has no key to encrypt your bid against, so it will not let you bid.

There is a subtle and revealing difference in how the two keys are treated. A signing key is generated inside your token and can never leave it, because a copy of a signing key anywhere else would destroy non-repudiation. An encryption key is deliberately recoverable through the Certifying Authority, because if you lose it, every document ever encrypted for you becomes unreadable forever. One key must never have a backup; the other must.

So which do you need? For incorporating a company, running MCA and GST and income tax filings: sign only. For bidding on government tenders (CPPP, state e-procurement, railways, defence): the combo. Buying the combo “just in case” costs you about Rs 1,000 for a capability you may never use, which is fine, as long as you know that is what you are buying.

The security rules nobody tells first-time directors

The visible stamp is not the signature. The “Digitally signed by …” box you see on a PDF page is only an appearance. The real signature is a cryptographic object embedded in the file. To verify one, open the signature panel in Adobe Acrobat, or use a verification tool. A PDF can carry a convincing-looking stamp and no valid signature at all.

Your token plus your PIN is your signature. The private key cannot be copied off the token, which is good, but it means whoever holds the token and knows the PIN can sign as you. A distressingly common arrangement in India is a director’s DSC token sitting in a drawer at their CA’s office with the PIN on a sticky note, signing whatever needs signing. Understand what that means: every form filed with it carries your legal signature. Keep a register of where each DSC is and what it was used to sign. Hand over the token for a specific filing if you must; never hand over standing access.

Automation has a proper channel. If your business needs to sign hundreds of invoices automatically, the answer is not exporting your personal DSC to a file on a server, which breaches CCA norms and makes every signature challengeable. The correct product is a Document Signer Certificate, issued specifically for server-side, unattended signing. eMudhra and other CAs sell these alongside HSM-backed signing services.

Expiry blocks everything. A DSC expiring is not statutory, but a director who cannot sign freezes every filing that needs their signature, and the renewal has the same verification steps as a fresh issue. Track expiry dates the way you track filing deadlines, because in practice one causes the other.

What this costs in an incorporation

In a standard two-director private limited incorporation, DSCs are Rs 3,000 to 5,000 of the total, the largest third party line after stamp duty. It is a vendor product with a negotiable price, which is why we buy at a bulk rate and pass it through at cost as a single stated number rather than a range. A quote that says “DSC extra” is a quote that has not finished counting.