Digital Signature Certificates in India: Class 3, Where They Are Mandatory, How to Get One, and When to Use Aadhaar eSign Instead
What a Digital Signature Certificate is, why only Class 3 is issued now, where a DSC is mandatory (MCA filings, tenders) and where it is optional, how to get and renew one, and when Aadhaar eSign is the better choice for contracts.
A Digital Signature Certificate (DSC) is the oldest form of legally recognised electronic signature in India and still the one that company filings require. Guides written before 2021 describe "Class 2" certificates that no longer exist. This is the current position: what a DSC is, where you need one, how to get it, and when a contract is better signed with Aadhaar eSign. Position as of October 2026.
What a DSC is
Under section 3 of the Information Technology Act, 2000, a digital signature authenticates an electronic record using an asymmetric crypto system and hash function: the signer's private key creates the signature, and anyone with the public key, bound to the signer's identity in a certificate, can verify it. The certificate is issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA). The private key is usually kept on a USB token. Section 5 gives a digital signature the legal effect of a handwritten one where a law requires a signature.
Classes: only Class 3 now
The CCA's guidelines of November 2020 discontinued the issuance of Class 2 certificates from 1 January 2021; Class 3 is the class issued for individuals and organisations since then, and existing Class 2 certificates remained usable until expiry. **** Rule 8 of the Companies (Registration Offices and Fees) Rules, 2014 still refers to class II or class III specification; in practice Class 3 is what you will obtain.
Where a DSC is mandatory
- Ministry of Corporate Affairs filings. Rule 8(1) of the Companies (Registration Offices and Fees) Rules, 2014: "An electronic form shall be authenticated by authorised signatories using digital signature." Directors, key managerial personnel and certifying professionals need DSCs for e-forms.
- Government e-tenders generally require DSC-based bid signing.
- Income-tax filings for companies and audited entities require DSC verification.
- GST: rule 26 of the CGST Rules, 2017 allows filing with a DSC or an e-signature under the IT Act, or another mode notified by the Board (the EVC route); the earlier proviso that made DSC compulsory for companies was omitted from 1 November 2021 by Notification No. 32/2021-Central Tax. ****
Where a DSC is optional, and often not the best choice
For commercial contracts, offer letters, vendor agreements and consents, a DSC is one valid method among several. Its drawbacks are practical: the counterparty must hold a token, tokens expire (typically after one to three years), and external signers rarely have one. Aadhaar eSign (section 3A and the Second Schedule) gives a section 5 signature without a token, authenticating the signer through UIDAI at the moment of signing. A sensible rule:
- DSC for your own authorised signatories who sign often, and for statutory filings.
- Aadhaar eSign for counterparties, employees and one-off signers who are Aadhaar holders.
- A platform signature with audit trail for low-value consents where no law requires a signature.
How to get a DSC
- Choose a licensed Certifying Authority or its registration partner (the CCA publishes the list).
- Complete identity verification: for individuals, Aadhaar-based or PAN-based e-KYC with video verification is standard; for organisations, authorisation documents for the signatory.
- Receive the certificate on a FIPS-compliant USB token; set the PIN.
- Register the DSC on the portals you will use (MCA, income tax, GST, tender portals).
- Note the expiry date and renew before it; a filing cannot be signed with an expired certificate.
Revocation and security
If the token is lost or the signatory leaves, ask the Certifying Authority to revoke the certificate; a signature made with a revoked certificate after the revocation time fails verification. Keep the token with the person named in the certificate, never "in the drawer for whoever needs it"; section 66C of the IT Act makes fraudulent use of another's electronic signature an offence punishable with up to three years' imprisonment.
Organisational DSCs and signing authority
A DSC proves the signer's identity, not their authority. A company's authority to bind itself comes from its board resolution or delegation matrix. Record both: the DSC in the audit trail, the resolution against the contract.
Where Legatio fits. Legatio supports DSC signing for authorised signatories and Aadhaar eSign for everyone else in the same workflow, and records the certificate details and resolution reference against each contract. Which method a filing or a counterparty needs is set by the regulator or agreed between the parties.
Position stated as of October 2026. General information, not legal advice.