About Class 3 DSC

Class 3 Digital Signature Certificate for company filings GST e-tendering and high-value transactions. Forms handled: Class 3 DSC, Aadhaar e-KYC. Legal basis: IT Act 2000 Sections 35-39 and CCA guidelines.

Glossary

Plain-English glossary for this service

Root Certificate

Self-signed top-level certificate anchoring trust chain operated by Controller signing all licensed Certifying Authority certificates.

Certifying Authority

Licensed entity under Section 24 authorised to issue suspend and revoke digital signature certificates.

Hardware Security Module

Tamper-resistant device generating storing protecting cryptographic keys used by Certifying Authority for root operations.

ProxKey

A FIPS 140-2 Level 2 USB cryptographic token from Watchdata, commonly bundled with Capricorn and Sify DSC issuances. Like ePass and MTok, ProxKey carries the holder's signing certificate and optional encryption certificate, and uses PKCS#11 for portal-side integration.

Relying Party

Recipient who validates signed electronic record by checking certificate status against repository before action.

Biometric Authentication

Fingerprint or iris matching against Aadhaar database confirming live presence during e-KYC application.

CRT File

Public certificate exported from token uploaded to portals like MCA GST mapping signer identity.

Certifying Authority

An entity licensed by the Controller of Certifying Authorities under Section 24 of the IT Act 2000 to issue Digital Signature Certificates in India. As of date, the live CAs include eMudhra, Sify Communications, (n)Code Solutions, Capricorn Identity Services, IDSign, Verasys and a handful of others. Each CA's certificates are valid pan-India and across all government portals.

Paperless e-KYC Issuance

Streamlined workflow leveraging UIDAI authentication eliminating physical document submission during certificate enrollment.

Non-Repudiation

Property preventing signer from denying authorship since only subscriber controls corresponding private signing key.

Certification Practice Statement

Public document published by Certifying Authority describing operational procedures meeting CCA licensing conditions.

Certificate Revocation

Permanent termination before expiry triggered by compromise misrepresentation organisational change or subscriber request.

Forms Library

Forms used in this engagement

Captures subscriber particulars name PAN address email mobile and class requested by applicant.

Records explicit subscriber permission to share demographic and biometric data with Certifying Authority under Aadhaar Act.

Subscriber declaration confirming authenticity of submitted PAN passport voter ID for paper-based applications.

Utility bill bank statement passport substantiating residence for non-Aadhaar verification route.

Board resolution authorising designated signatory to obtain certificate for entity filings.

Entity GSTIN proof submitted for organisation class certificates linked to company filings.

Mandatory identity document cross-verified with Income Tax database during application processing.

Recent colour photograph affixed on physical application or uploaded for digital workflow.

Subscriber recites application reference number on camera fulfilling identity proofing requirement.

Contractual document binding subscriber to safeguard signing key and notify compromise immediately.

Triggers immediate suspension when token lost compromised or subscriber leaves organisation.

Simplified workflow leveraging existing subscriber records to issue replacement before validity lapses.

Statutory Deadlines

Compliance deadlines that matter

Miss any of these and the next consequence kicks in automatically.

Trigger event	Days	Form	Consequence
Class 3 DSC application submitted under Aadhaar OTP paperless e-KYC route	On due date	Application form with Aadhaar OTP authentication and PAN verification	Same-day issuance possible if Aadhaar biometric lock is open and OTP delivers; failure of OTP route forces switch to video-verification with 1-2 day SLA, potentially missing same-day signing requirements
Class 3 DSC application submitted under video-verification e-KYC route	2 days	Application form with recorded verification video, PAN and Aadhaar / passport images	1-2 working day standard SLA before certificate is issued; applicants needing same-day signing must plan ahead or default to Aadhaar OTP route; NRI and biometric-locked applicants have no faster option
Class 3 DSC approaching natural expiry — 1 / 2 / 3 year validity exhausted	15 days	Fresh DSC application with paperless or video e-KYC; renewal in the same name treated as fresh issuance	Renewal initiated within 15 days before expiry ensures uninterrupted signing capability; certificates that expire mid-filing cycle cause per-day late-fee exposure on MCA forms under Section 403 of the Companies Act and GST late-fee under Section 47
DSC has expired and holder needs to sign filings on MCA / GST / Tendering portals	On due date	Fresh Class 3 DSC issuance — expired certificates cannot be renewed in place	Until fresh DSC is issued, all signature-mandatory uploads fail; MCA forms attract ₹100 per day per company per form under Section 403; GST returns attract ₹50 per day under Section 47; tender bids missed
USB token containing live DSC is lost, stolen or suspected compromised	On due date	Section 38 suspension / revocation request to issuing CA, supported by FIR / affidavit	Immediate revocation listing on CRL prevents fraudulent use under Section 66C of the IT Act; delay in filing the Section 38 request leaves the certificate live and the holder exposed to mis-use liability until expiry
DSC holder forgets the token password but certificate is within validity	On due date	Password / PIN reset workflow with issuing CA — typically Aadhaar OTP re-authentication	Reset within the certificate validity preserves the remaining months and avoids ₹1,500 fresh-issuance cost; multiple wrong-password attempts trigger token lockout in many models, after which only fresh issuance is possible
Authorised signatory of an organisational DSC ceases to be authorised (resignation, role change, board revocation)	On due date	Section 38 revocation request to issuing CA + fresh organisational DSC for the new signatory	Organisational validity terminates with the underlying authorisation regardless of chronological expiry; continued use exposes the company and the individual to Section 66 / 66C liability and Companies Act compliance defects
Private key believed to have been exposed or token suspected to have been cloned	On due date	Section 38 suspension request to issuing CA with incident-report	Suspension flips the certificate status on the CRL within hours; signatures generated after suspension fail verification on every portal; failure to suspend allows continuing fraudulent signing
One-time signing requirement and no Class 3 DSC available (e-Sign alternative)	On due date	Aadhaar e-Sign single-use signature under Section 3A of the IT Act	e-Sign generates and destroys the signing key in a single transaction — no token, no renewal, no recovery; suitable as a stop-gap for one-off filings but not for repeat use because each invocation is a fresh transaction
Hardware token develops a read-error or LED-failure under warranty	On due date	Hardware-replacement ticket with issuing CA / token vendor; existing certificate re-keyed onto replacement token	Replacement within 1-3 working days under standard 1-year hardware warranty preserves the existing certificate validity; out-of-warranty failures require fresh DSC issuance

Comparison

Class 3 Signature DSC vs Class 3 Combo DSC

Aspect	Class 3 Signature DSC	Class 3 Combo DSC
Statutory basis	Issued under Section 35 of the Information Technology Act 2000 read with Rule 23 of the IT (Certifying Authorities) Rules 2000 and the CCA India X.509 Certificate Policy v1.6 (2021) — carries only the signing key pair used for authentication and non-repudiation	Issued under the same Section 35 IT Act 2000 framework but provisions two key pairs on one token — a signing certificate plus a separate encryption certificate under the CCA Interoperability Guidelines 2021 for confidentiality of exchanged data
What it actually does	Digitally signs and time-stamps a document so the signer cannot repudiate it — sufficient for MCA21 V3, GST, Income-tax, EPFO, TRACES and ROC filings where only authentication is required	Signs documents AND decrypts encrypted data — mandatory where the portal encrypts payloads back to the holder, chiefly e-Procurement (GeM, CPPP, state e-tender portals) and IP India trademark/patent e-filing
Who typically needs it	Directors, proprietors, tax practitioners and authorised signatories filing statutory returns — the overwhelming majority of Chennai business users	Contractors and vendors bidding on government e-tenders, exporters on ICEGATE tender modules, and applicants filing trademarks or patents where bid or filing data is returned encrypted
Token and standard	Stored on a FIPS 140-2 Level 2 crypto USB token (ePass2003 / mToken / ProxKey); one key pair and one certificate on the device	Same FIPS 140-2 Level 2 token but holds two certificates — losing or corrupting the token invalidates both the signing and encryption keys together
Validity and renewal	Issued for 1, 2 or 3 years; renewed via fresh Aadhaar/PAN e-KYC before expiry — an expired signature certificate silently blocks the next MCA or GST filing	Same 1–3 year validity, but on renewal the encryption certificate must also be re-keyed; data encrypted to the old key cannot be decrypted with the new one, so archive access must be planned before renewal
Indicative cost	Approximately ₹1,200–₹1,500 one-time inclusive of the token, Aadhaar e-KYC and video verification, for a 2-year certificate	Approximately ₹1,800–₹2,500 one-time for the same 2-year term, the premium reflecting the additional encryption key pair and its separate CCA-mandated verification