What a DSC does
A digital signature certificate is the online equivalent of your signature and company seal. When you submit a bid on an e-procurement portal, you sign it with your DSC, which proves the bid came from you and hasn’t been altered since. An unsigned bid can’t be submitted.
The certificate itself sits on a USB crypto token. Plug the token in, enter its PIN, and the portal’s signing utility uses the key on it to sign. The key never leaves the token.
Which DSC you need
Class 3. Under the rules of the Controller of Certifying Authorities (CCA), Certifying Authorities no longer issue Class 2 individual signing certificates on their own — every individual signing certificate issued today is Class 3. Older tender notices that say “Class II or Class III” are satisfied by a Class 3 certificate.
Personal or organisational? A personal DSC identifies you as an individual. An organisational DSC identifies you as a person authorised by a company, and is issued after the Certifying Authority checks the organisation’s documents. Most companies bid with an organisational DSC in the name of their authorised signatory.
Signing or signing-plus-encryption? The central portal (CPPP) and NIC’s state portals ask bidders for a Class 3 certificate with signing capability. Your bid is encrypted with the certificates of the buyer’s bid-opening officers, not with yours. But some other portals ask bidders for both signing and encryption certificates. If you’ll bid across portals, buy a signing-plus-encryption combo — it costs little extra and works everywhere.
How to get one
- Choose a licensed Certifying Authority. The CCA lists the companies licensed to issue DSCs in India — eMudhra, (n)Code, Capricorn, Sify Safescrypt, Protean, IDSign, PantaSign, CDSL Ventures and others. Any of them will do.
- Apply online, choosing Class 3, personal or organisational, signing or combo, and a validity of one to three years.
- Verify your identity. PAN or Aadhaar is mandatory, and PAN is checked against the Income Tax database. Identity is confirmed by video verification or Aadhaar eKYC. For an organisational DSC, you also submit the organisation’s documents.
- Get the token. The key is generated on a FIPS-certified crypto token. You must set your own PIN — tokens can’t keep default passwords.
Prices vary by provider and validity. A two-year Class 3 signing-plus-encryption certificate with a token typically costs a few thousand rupees.
Guard the PIN. If you forget it, the token has to be re-initialised, which wipes the certificate. Certifying Authorities must re-issue it free at least once, but it costs you time.
Registering your DSC on the portal
Having a DSC isn’t enough — you have to link it to your bidder account on each portal:
- Enrol as a bidder on the portal (free on CPPP and NIC portals).
- Log in with the token plugged in and register the certificate against your account.
- Get your computer ready. NIC’s guidance asks for a supported browser and the right signing components; large uploads may need extra settings. Install the portal’s signing utility and test it before you need it.
- Re-register after renewing. A renewed or new DSC must be registered again.
Do all of this days before your first deadline, not hours.
Common DSC problems on bid day
| What you see | What it usually means |
|---|---|
| “Certificate not mapped to the user” | The token you’ve inserted isn’t the DSC registered on your account — or you renewed and didn’t re-register. |
| The signing utility doesn’t respond | The signer component isn’t installed or running. Reinstall it and re-import the certificate. |
| Signing fails with a validity error | The certificate has expired. Renew and re-register it. |
| Token PIN locked | Too many wrong attempts. Contact your Certifying Authority to reset it. |
Questions
Is a Class 2 DSC still valid for e-tendering?
Certifying Authorities no longer issue Class 2 individual signing certificates on their own — every individual signing DSC issued now is Class 3. If a tender notice still says ‘Class II or Class III’, a Class 3 certificate satisfies it.
Can I use one DSC on several portals?
Yes. You register the same DSC separately on each portal you bid on — CPPP, your state’s portal, and so on.
How long is a DSC valid?
Up to three years — the maximum the national certificate policy allows. Certifying Authorities typically sell one-, two- and three-year certificates.
Do I need a DSC on GeM?
No. GeM lets you sign bids, contracts and invoices with an OTP, Aadhaar- or PAN-based eSign, or a DSC. GeM has said OTP signing is temporary, so eSign is the safer default.
What if my DSC expires in the middle of a tender?
You can’t sign with an expired certificate. Renew it before the deadline and register the new certificate on the portal before you submit — allow a day for this.
Sources
- Identity Verification Guidelines — Controller of Certifying Authorities
- Certificate Policy for India PKI — Controller of Certifying Authorities
- Licensed Certifying Authorities — Controller of Certifying Authorities
- Hassle-free bid submission — NIC e-procurement guideline
- Seller FAQs (signing on GeM) — Government e-Marketplace
This guide explains the rules in plain English; it isn’t legal advice. Procurement rules change, and each tender document sets its own conditions — it always prevails.