DSC for Income Tax Filing in India: Setup, E-Verification, and Renewal

If you file income tax in India as a company, a political party, or a taxpayer whose accounts must be audited, you are required to attach a digital signature certificate when you submit your return, and the e-filing portal will not accept the return without one. Everyone else can verify their return through simpler methods and does not need a DSC for income tax filing in India at all. A DSC uses a pair of cryptographic keys, stored on a USB token, to confirm who submitted the return and to guarantee the data was not altered after submission.¹

Who Is Required to Use a DSC

The Income Tax Department mandates DSC-based e-verification for three categories: all companies (including foreign companies registered in India), political parties, and any person whose accounts must be audited under the Income Tax Act.¹ For these filers, the certificate is not optional.

Political parties are the only ITR-7 filers compelled to sign with a DSC. Other ITR-7 filers, such as trusts and research associations, can verify with Aadhaar OTP, an electronic verification code, or a signed physical ITR-V mailed to the processing centre.² They fall into the DSC bracket only if the audit rule catches them independently.

Audit Thresholds Under Section 44AB

Whether the audit requirement drags you into DSC territory depends on turnover or receipts. Under Section 44AB, a tax audit is mandatory if business turnover exceeds ₹1 crore in a financial year. The threshold rises to ₹10 crore where cash receipts and cash payments each stay below 5% of total receipts and total payments. For professionals, the trigger is gross receipts above ₹50 lakh.³ Taxpayers under the presumptive taxation scheme who declare profits below the prescribed rate also fall under the audit net regardless of turnover.

Check the previous year’s financials against these figures before assuming you can skip the certificate. If you cross any of them, you must e-file and verify with a DSC.

When a DSC Is Not Required

Individual taxpayers, HUFs, and firms not subject to audit have alternatives. The e-filing portal accepts Aadhaar OTP, an EVC generated through a linked bank account or demat account, net banking, or a bank ATM-generated EVC. You can also post a signed ITR-V to the Centralized Processing Centre in Bengaluru within 30 days of filing.² Aadhaar OTP is the fastest of these for most individuals. A DSC still works if you prefer it, and it can be worth the cost if you file for multiple entities or handle broader business compliance.

Getting a Digital Signature Certificate

DSCs are issued by Certifying Authorities licensed by India’s Controller of Certifying Authorities. The CCA maintains the current list of approved issuers.⁴ The e-filing portal accepts both Class 2 and Class 3 certificates stored on a USB token.⁵ Class 3 offers stronger identity assurance and is typically what authorities recommend for tax filings, but a valid Class 2 works as well.

Application procedures vary slightly between issuers. You will generally need a PAN card, a valid identity proof such as Aadhaar or passport, address proof, and a recent photograph. Most authorities verify identity through Aadhaar-based e-KYC or a video verification call. The certificate arrives on a physical USB token that stores your private key.

Cost and Validity

Certifying Authorities issue certificates with one-year or two-year validity, and two years is the maximum allowed.⁶ A Class 3 signing certificate typically costs between ₹1,500 and ₹2,500 depending on provider and duration. Two-year certificates are marginally more expensive and save an annual renewal cycle. When the certificate expires, you pay the Certifying Authority again for a fresh one on your token.

NRIs and Non-Resident Directors

Non-resident Indians can obtain a DSC for Indian tax filing, though documentation is heavier. NRIs typically need their passport and PAN as identity proof, plus a foreign address proof such as a bank statement or utility bill. Most Certifying Authorities require attestation by the Indian Embassy, or an apostille for Hague Convention countries. A video verification call replaces in-person identity checks. For non-resident directors of foreign companies, the e-filing portal registers the DSC against the director’s email address rather than a PAN-linked profile.¹

Installing emBridge and Registering the Certificate

The e-filing portal communicates with your USB token through a utility called emBridge, which you download from the portal’s DSC Management Utility page.⁷ Older documentation still refers to a utility called emSigner, but the portal has moved to emBridge. Unlike the earlier tool, emBridge does not need Java. It runs on Windows 7 and above, macOS 10.12 and above, and Linux distributions including Ubuntu, CentOS, and Red Hat.⁸ Install it, confirm it is running in the background, and only then plug in your token.

Register the certificate against your e-filing account before you attempt to sign any return. This is a one-time step that lasts until the certificate expires. Log in, click your name in the top-right corner, open My Profile, and select Register DSC from the left-side menu.⁵ Confirm that emBridge is installed, click Continue, select your certificate provider and the specific certificate on the connected token, enter the token PIN, and click Sign. A success message confirms registration.

If your certificate later expires or you switch tokens, return to the same Register DSC page. If the old certificate has expired, the system prompts you to register a valid one. If the old certificate is still active but you want to change it, click View to see current details and then register a new DSC.⁵ The new certificate replaces the old one for future signing.

Using the DSC to E-Verify a Return

After the return is prepared and submitted, the verification screen offers a DSC option. Make sure emBridge is running and the token is plugged in before you reach this step. Select the DSC option, choose your certificate when prompted, and enter the token PIN. A confirmation appears on screen and an acknowledgment goes to your registered email.

The portal then generates an ITR-V that acts as your official receipt. Electronic verification completes the filing; nothing needs to be posted to the processing centre. Keep the ITR-V acknowledgment with your records for the assessment year.

Fixing Common Signing Errors

The signing step is where most technical problems appear. The Income Tax Department’s DSC tutorial lists the frequent errors and their fixes.⁹

Certificate mismatch. For company PANs, the DSC must belong to the Principal Contact and must have been registered from that person’s login. The certificate used for e-verification and the one registered on the portal must be identical.
“Something went wrong” during e-verification. Uninstall emBridge, download the latest version from the official emBridge site, and reinstall. Delete the existing certificate in the Epasstoken tool and import it again before retrying.
Dropdown values not appearing. Follow the same reinstall-and-reimport process. If the problem persists, the certificate file may be corrupted; contact your Certifying Authority for a replacement.
Token not detected. Launch emBridge before plugging in the token; order matters. Confirm the Epasstoken application is also running. If the token still is not recognized after a restart and reimport, the hardware may be faulty.

Most of these come down to an outdated emBridge installation or a certificate that needs reimporting. Reinstalling the utility resolves the majority of cases before you need the helpdesk.

Renewal, Expiry, and Lost Tokens

A DSC cannot be used for e-filing once it has expired or been revoked. The portal will reject any signing attempt with an expired certificate and display an error asking you to register a valid one.¹ There is no grace period. If the certificate expires the day before you file, you are stuck until a new one is issued.

Because two years is the ceiling, plan renewal a few weeks before expiry, especially if a filing deadline is close.⁶ Renewal means paying the Certifying Authority again and receiving a fresh certificate. Once you have it, re-register the certificate on the e-filing portal. Corporate taxpayers with October audit deadlines should be especially careful, since procuring a certificate during peak season can take longer than expected.

If the USB token is lost or stolen, contact your Certifying Authority’s Registration Authority at once to suspend the certificate. Revocation can typically be requested through the authority’s online portal or by contacting the nearest Registration Authority office. Only the certificate holder, an authorized representative, or the Certifying Authority itself can start the process.¹⁰ After revocation, the certificate appears on the authority’s Certificate Revocation List, which the e-filing portal checks during signing. You will need a new certificate and a fresh registration on the portal before your next filing. A revoked certificate cannot be reinstated.

What Happens If You Skip a Required DSC

A return filed without a DSC by someone in a mandatory category can be treated as defective under Section 139(9). You will receive a defective return notice giving you 15 days from the date of the notice, or a longer period if specified, to correct the defect. You can ask for an extension if you need more time.¹¹

If you miss that window, the return is treated as invalid, effectively as if it was never filed. The downstream consequences include a late filing fee of up to ₹5,000 under Section 234F (₹1,000 if total income is below ₹5 lakh), interest on any outstanding tax, loss of the ability to carry forward losses, and possible loss of specific exemptions. In practice the portal will usually block a mandatory filer from completing verification without a certificate, but the defective-return pathway is the backstop when a filing slips through.

1
Income Tax Department. Register Digital Signature Certificate FAQ
2
Income Tax Department. FAQs on ITR-7
3
Income Tax Department. Section 44AB
4
Controller of Certifying Authorities. Licensed Certifying Authorities
5
Income Tax Department. Register Digital Signature Certificate User Manual
6
eProcurement System Government of India. Frequently Asked Questions on Digital Signature Certificate
7
Income Tax Department. Downloads – DSC Management Utility
8
eMudhra. emBridge
9
Income Tax Department. DSC Tutorial
10
IDRBT Certifying Authority. Frequently Asked Questions
11
Income Tax Department. Response to Defective Notice 139(9) FAQs