Digital Signature Certificate (DSC)

A Digital Signature Certificate (DSC) is a legally valid electronic credential that authenticates the identity of the signer and provides tamper-proof signing of digital documents. In Indian government procurement, a Class III DSC is mandatory for submitting bids on all major e-procurement portals including CPPP, GePNIC state portals, IREPS, GeM, and most PSU portals. Without a valid DSC, a firm cannot submit a bid on these platforms, regardless of its eligibility or pricing.

What is a Digital Signature Certificate in government procurement?

DSCs in India are issued under the Information Technology Act 2000 by licensed Certifying Authorities (CAs) appointed by the Controller of Certifying Authorities. For government procurement, only a Class III DSC is accepted, as it provides the highest level of identity verification. Class III DSCs are issued after in-person or video-verified identity verification of the authorised signatory.

The major licensed CAs in India include eMudhra, Sify Technologies, nCode Solutions (NIC's CA arm), CDAC, Capricorn Identity Services, and a few others. All charge a fee for issuance, typically Rs 1,000 to Rs 3,000 for a two-year DSC, with a USB crypto token device to store the private key.

DSCs are issued in the name of an individual, typically the Director, Partner, or Authorised Signatory of the company. The certificate contains the individual's name, the organisation's name, the email address, and the validity period. A two-year DSC is standard; three-year DSCs are also available. Once expired, the DSC cannot be used for signing and must be renewed, which requires a fresh application.

For bid submission, the DSC must be installed on the computer from which the bid is uploaded. The USB crypto token is plugged in, and the portal software or browser extension prompts the user to select the certificate and enter the token PIN during the upload and submission process. The signed bid is cryptographically locked with the private key and cannot be altered after signing without breaking the signature.

The DSC used for signing Cover 1 (technical bid) and Cover 2 (financial bid) must match the DSC registered on the portal by the bidding company. A mismatch results in a submission error. Bidders must ensure the registered DSC is the one physically available on submission day.

Why it matters for bidders

DSC management is a basic operational necessity for government procurement participation. Common failures include DSC expiry discovered only when preparing a bid, the DSC holder leaving the company and taking the token, the token PIN being lost, or the wrong DSC being registered on a portal relative to the one available.

Best practices include maintaining two DSCs for the organisation's authorised signatory (one as the active key and one as a backup), tracking renewal dates on a calendar alert at least 30 days before expiry, and storing the token and its PIN securely with the person responsible for bid submission. If the authorised signatory changes, the portal registration must be updated with the new DSC before the next bid is submitted.

DSCs issued for one e-procurement portal generally work on other portals as well, since the technology standard is common. However, some portals require the DSC to be registered on their system before first use, which is a one-time step that takes a day or two to process.

Key rules and thresholds

Class III DSC is required for all government e-tenders. Class I and Class II DSCs are not accepted. The DSC must be in the name of the person authorised to sign bids on behalf of the company, typically supported by a board resolution or power of attorney. On GeM, the organisation admin's DSC is linked to the seller account and must be kept current. On CPPP and GePNIC portals, the DSC is used to sign and encrypt the bid at the time of upload.