Contract Guides

Class 3 Digital Signature Certificates in India: Purpose, Use and Renewal

By Anirudh Menon, Viaclause editor

Understand Class 3 DSC assurance, current CCA verification guidance, portal compatibility and renewal. Use a certificate selection and submission handoff worksheet.

Updated October 12, 2026digital signature certificate class 3

A Class 3 Digital Signature Certificate, or DSC, is a certificate issued under the highest of the three assurance levels in India's public-key infrastructure certificate policy. It binds a verified subscriber identity to a public key. See CCA policy sections 1.2 and 3.2.3. Its class describes assurance; the certificate's permitted use, your authority and the receiving application's requirements still matter.

This India-specific guide uses CCA guidance inspected October 6, 2026. It includes a practical selection worksheet and a fictional renewal example, not a live certificate purchase or portal test. For the wider signing process, see our electronic-signature guide.

What Class 3 tells you

The CCA Certificate Policy, version 1.10, identifies Class 3 as 2.16.356.100.2.3 and constrains use through key-usage, extended-key-usage and policy fields. Inspect those fields rather than relying on the seller's product name.

Three questions help keep the purchase useful: whose identity does the certificate describe, what operation is it intended for, and will the destination accept it for this specific submission? A certificate can be genuine while a filing fails because the profile, role or registered certificate is wrong.

Three separate checkpoints: inspect the certificate, confirm portal and role compatibility, then preserve the signed file and submission receipt. — Original operational illustration. Each checkpoint needs its own evidence; a purchased certificate is not a completed submission.

Choose the issuer, subscriber and purpose

Start with the CCA licensed-CA disclosure directory and confirm the actual issuing CA, including when buying through a reseller. Ask the issuer to identify its applicable certification practice statement and the product suited to the named portal. This guide does not recommend a particular supplier.

Choice	Question before purchase	Record to retain
Personal or organisational person	Who signs, and in what capacity?	Exact subscriber name, organisation fields and authority record
Signing or encryption	Does the task require signing, decrypting or both?	Written product scope and permitted-use fields
Target portal	Which profile, identifier and certificate type must match?	The current instructions for the specific task
Custody and support	Who controls the token or supported signing environment?	Custodian, approved setup and issuer support route
Validity and total price	What dates, device costs and services are included?	Itemised quotation and issued certificate details

A signing requirement is not a reason to buy an encryption product without checking its scope. CCA's June 2026 Identity Verification Guidelines treat encryption certificates separately, including key escrow. Keep the two purposes distinct when discussing recovery with the CA.

For an organisational person, the same guidelines require organisation and authorised-signatory verification. Keep transaction-specific approval separately: approved signer, spending limit and permitted document. A job title alone should not close that check.

Current identity checks and key custody

Version 2.6 of the Identity Verification Guidelines, dated June 16, 2026, permits direct interactive video verification or online Aadhaar biometric verification for the physical-verification requirement. Requirements vary with the KYC route. It specifies Class 3 individual signing issuance, including personal and organisational-person certificates, with both Class 2 and Class 3 policy identifiers on validated hardware crypto tokens; Class 2 individual signing certificates alone are not to be issued. Consult the issuer for your category and supported device.

Use the CA's official interface and instructions. Review the populated identity and organisation information before completing the application. Do not let a helper choose a certificate for you solely because it is labelled “highest security.” An error in the subscriber or organisation fields can be harder to discover than an obvious missing device.

Keep the signing secret under the intended signer's control. A procurement colleague can collect the product quotation and portal requirements without receiving the signer's PIN. For a practical explanation of cryptographic evidence and visible marks, see digital versus electronic signatures.

Income Tax and DGFT: check the actual application

The Income Tax Department's Register DSC manual lists a registered e-Filing user, installed signing utility and a Class 2 or Class 3 USB token among its prerequisites. Its documented route is My Profile, Register DSC: enter the relevant PAN details, confirm the utility, select the provider and certificate, enter the signing password and sign. It also covers re-registration and the principal-contact DSC.

Registration prepares the credential for use. It is not evidence that a particular return has been filed or that every taxpayer must use DSC. Check the instructions for that return, the required signatory and the final acknowledgement. Obtain utility downloads through the official portal's guidance and your approved IT process.

The DGFT IEC manual, version 4.1, sections 7 and 24, describes generic individual and organisation-based Class 2 or Class 3 support, alongside limited continued support for IEC-based certificates. It requires a valid certificate and describes entity-specific identity matching. Registration follows applying for or linking an IEC. A seller's “DGFT DSC” label therefore needs checking against the exact current task, profile and supported certificate.

These manuals describe application acceptance. CCA's issuance rules describe what a CA may issue now. Those are different questions. Avoid turning either into a claim that one purchase automatically works on every government portal.

Renewal, replacement and revocation

CCA policy sections 4.6 and 4.7 distinguish conditional renewal with the same public key from re-keying with a new key pair. Both issue a different serial number. Ask what the issuer's commercial “renewal” means, then inspect the issued certificate.

Record the new certificate separately, check each destination's registration procedure and perform an authorised readiness check before a deadline. Preserve the old certificate information with earlier signed files. Our contract-repository guide explains how to keep signed records and their evidence retrievable.

CCA policy section 4.9 covers key loss, suspected compromise and authenticated revocation requests without a grace period. Follow the issuer's process promptly. Document unavailable status evidence rather than silently recording “valid.”

Worked renewal handoff

Fictional scenario: Meera signs for fictional Rivergate Components. Its internal readiness target is October 15, 2026; a planned submission is October 20. The old certificate expires October 31. These are invented planning facts, not provider processing promises.

Checkpoint	Fictional observation	Result
October 15	Replacement issued; new serial and public key observed	Record a re-keyed certificate, despite the invoice saying renewal
October 16	The destination profile still references the old certificate	Readiness stays open; issuance alone is insufficient
October 18	Supported re-registration completed; current role checked	Record registration evidence, without claiming the future filing is complete
October 20	Expected submission and acknowledgement recovered	Close this submission only; retain its signed output and receipt

The October 15 target leaves five calendar days before the planned submission. It is the company's chosen buffer, not an assurance that issuance or portal support will take five days. If the final response is missing, keep the outcome unknown and reconcile the existing attempt before assuming it failed or submitting again.

Copyable certificate and submission record

Use this operational worksheet without recording a PIN, private key or unnecessary identity-document copies:

Task and destination: [specific filing or agreement]
Required signer and capacity: [person, organisation, role]
Authority evidence: [approval reference and limits]
Current portal instructions: [URL, version, date checked]
Issuer and product purpose: [CA, signing/encryption scope]
Certificate reference: [issuer + serial; public information]
Policy and permitted-use review: [observations, reviewer]
Validity and status check: [dates, result, time, limitations]
Custodian and approved environment: [owner, setup reference]
Registration evidence: [profile, confirmation reference]
Signed output: [repository reference, preserved original]
Submission outcome: [accepted / failed / unknown]
Acknowledgement: [reference, or missing]
Next action and owner: [specific action, date]

Legal scope in India

The IT Act, sections 3 and 5, addresses digital authentication and legal recognition of prescribed electronic signatures. Section 10A prevents electronic formation alone from making a contract unenforceable. That is not a certificate-based guarantee of every agreement's enforceability.

Assess the transaction, authority and applicable signing, stamp, witness or registration formalities. Read older First Schedule compilations with later changes, including S.O. 4720(E), the 2022 amendment. Do not infer document eligibility from a certificate class. Our Aadhaar eSign guide discusses that separate Indian workflow and its scope.

Checklist before the deadline

Name the exact destination, task and signatory.
Confirm the issuing CA and the needed product purpose.
Check subscriber, organisation and portal profile information.
Complete the applicable identity and authority checks.
Keep custody with the intended signer.
Record certificate details, validity and status limitations.
Check registration after renewal or replacement.
Retain the signed original and actual submission acknowledgement.
Assign an owner to every unresolved check.

Frequently asked questions

How do I know whether my DSC is Class 2 or Class 3?

Inspect the certificate's policy identifiers and issuer documentation. Compare them with the CCA policy linked above. A product advertisement or token casing is insufficient evidence; ask the issuing CA if the displayed certificate details are unclear.

Can I use a Class 3 DSC for an income tax return?

The registration manual includes Class 3 tokens. Confirm the return-specific signing requirement, eligible signer and successful registration, then preserve the filing acknowledgement. Registration and filing are separate events.

Is a DGFT DSC a higher class than Class 3?

The label alone does not establish another assurance class. Check the IEC task and identity requirements in the DGFT manual, together with the certificate's actual policy and usage fields.

What does a PantaSign or another provider's Class 3 DSC cost?

We have not verified a current price. Request an itemised quote stating validity, subscriber category, token, tax, delivery and support. Compare equivalent scope rather than inventing a universal rate.

Is Class 3 DSC the same as Aadhaar eSign?

No. CCA's eSign overview describes an online service using authentication, certificate creation and backend signing with a one-time key. Follow the destination's supported route rather than treating a physical token and an eSign request as interchangeable.

Does renewal validate all my old signed files?

No automatic conclusion follows from obtaining a new certificate. Inspect each earlier file's signature evidence and applicable validation context. Preserve earlier outputs and certificate information; a newly registered credential is evidence about a later event.

Banner: AI-generated documentary illustration of fictional adults; no real transaction or person is depicted.