Digital Signature Certificate (DSC) for GST & MCA: Class 3 Rules, USB Tokens & Signing
Rahul Verma
· Direct & Indirect Tax Specialist· 6 min read
In India's digitized corporate compliance ecosystem, a physical blue-ink signature on paper holds zero value for statutory filings. From submitting GSTR-1 on the GST Portal to filing Director KYC (DIR-3 KYC) or Annual Accounts (AOC-4) on the Ministry of Corporate Affairs (MCA) portal, a Class 3 Digital Signature Certificate (DSC) is mandatory. Here is the operational guide to Class 3 DSC rules, USB cryptographic tokens, and resolving browser emSigner errors.
- ✓Class 3 DSC is the highest level of cryptographic digital signature certificate issued in India under the Information Technology Act 2000.
- ✓Under Rule 26 of the CGST Rules, Companies, LLPs, Foreign Companies, and Foreign LLPs must mandatorily file all GST returns, registrations, and refund claims using DSC.
- ✓Proprietorships and Partnership firms can use Electronic Verification Code (EVC) via Aadhaar OTP, but corporate entities cannot.
- ✓All Class 3 DSCs must be stored on FIPS 140-2 Level 2 certified hardware cryptographic USB tokens (e.g. ePass2003, WatchKey) to prevent private key extraction.
What is a Class 3 DSC and who issues it?
A Digital Signature Certificate (DSC) is a cryptographically secured electronic key issued under the authority of the Controller of Certifying Authorities (CCA) under Section 24 of the Information Technology Act 2000.
Following CCA guidelines, Class 1 and Class 2 certificates were discontinued. Today, only Class 3 DSCs (providing the highest level of identity verification via biometric or video KYC) are issued for all commercial, tax, and procurement purposes in India.
Authorized Certifying Authorities (CAs) include: eMudhra, Capricorn, Vsign, NSDL (Protean), and Pantasign.
When is DSC legally mandatory vs when is EVC allowed?
Rule 26(1) of the CGST Rules establishes a strict dividing line based on the constitutional nature of the business:
| Constitution of Business | Applicable Statutory Rule | Mandatory Signing Method | Can Use Aadhaar OTP (EVC)? |
|---|---|---|---|
| Private Limited Company | Rule 26(1) Proviso CGST Rules | Class 3 DSC (Signing + Encryption) | NO (Strictly prohibited) |
| Public Limited Company | Rule 26(1) Proviso CGST Rules | Class 3 DSC (Signing + Encryption) | NO (Strictly prohibited) |
| Limited Liability Partnership (LLP) | Rule 26(1) Proviso CGST Rules | Class 3 DSC of Designated Partner | NO (Strictly prohibited) |
| Sole Proprietorship | Rule 26(1) CGST Rules | Class 3 DSC OR Aadhaar OTP (EVC) | YES (EVC freely permitted) |
| Partnership Firm | Rule 26(1) CGST Rules | Class 3 DSC OR Aadhaar OTP (EVC) | YES (EVC freely permitted) |
| Hindu Undivided Family (HUF) | Rule 26(1) CGST Rules | Class 3 DSC OR Aadhaar OTP (EVC) | YES (EVC of Karta permitted) |
Hardware crypto tokens: Why private keys cannot be copied
A Class 3 DSC is never delivered as a downloadable file on your desktop. Per CCA security guidelines, the private key is generated and stored inside a FIPS 140-2 Level 2 certified USB Cryptographic Token (such as ePass2003, ProxKey, or WatchKey).
The USB token hardware prevents the digital certificate from being duplicated or exported. If you misplace the physical USB dongle or forget the token PIN after 15 consecutive attempts, the token permanently self-destructs and you must purchase a fresh DSC.
Troubleshooting emSigner Port Errors
The most frequent issue on the GST and MCA portals is 'Failed to establish connection to server'. To fix: always run emSigner as Administrator, verify port 1585 is open, clear Chrome SSL state, and ensure your DSC token driver (ePass2003) is updated.
Validity and renewal of Class 3 DSCs
Class 3 DSCs are issued with a validity period of 1, 2, or 3 years. When a DSC expires, you cannot simply pay a fee to extend the date; the Certifying Authority must perform a fresh video recording and PAN verification to re-confirm the director's identity.
Related Dyopact Tools & Templates
Frequently Asked Questions
Can a private limited company file GSTR-3B using an Aadhaar OTP?
No. Under the first proviso to Rule 26(1) of the CGST Rules, a company must file all GST returns, registrations, and refunds exclusively with a Digital Signature Certificate (DSC). Using EVC is legally invalid for companies.
Can one director's DSC be used for multiple companies?
Yes. Since a DSC verifies the personal identity of the individual (linked to their PAN and DIN), a director who serves on the board of 3 different companies can register and use the same Class 3 DSC across all 3 company profiles on MCA and GST portals.
What is the difference between DSC Signing and DSC Combo (Signing + Encryption)?
A Signing DSC is used for authenticating tax returns, PDF documents, and MCA forms. A Combo DSC includes both Signing and Encryption certificates, which is required for e-Tendering and government e-Procurement portals like GeM, CPPP, and railway tenders.
How long does it take to obtain a Class 3 DSC?
With paperless online e-KYC using Aadhaar and mobile OTP followed by a 20-second video recording, a Class 3 DSC is typically approved and downloaded onto a USB token within 15 to 30 minutes.
Rahul Verma
Direct & Indirect Tax SpecialistOver a decade advising Indian businesses on GST Rule 46 invoicing, E-Way Bill transit compliance, and corporate tax structuring.